Most Barbadian businesses build their lists the same way: a guest book at the front desk, a raffle at a Crop Over fete, a sign-up box at the online checkout, business cards collected at a conference at the Lloyd Erskine Sandiford Centre. The question is which of those contacts you are actually allowed to email. Under the Data Protection Act, 2019–29, in force since 31 March 2021, the answer depends on whether you can show a lawful basis. For promotional messages, that means consent in almost every case. This is general information, not legal advice.
What counts as consent in Barbados
The Act defines consent as a “freely given, specific, informed and unambiguous indication” of the person’s wishes, given by a statement or by a clear affirmative action. Broken down, that means four tests:
- Freely given: signing up for your newsletter should not be a condition of booking a room or opening an account.
- Specific: consent to receive a booking confirmation is not consent to receive promotions. Ask separately.
- Informed: people should know who you are and what you will send, for example “monthly offers from our Holetown restaurants”.
- Unambiguous: an empty checkbox the person ticks, or a button labelled “Subscribe”. Silence, pre-ticked boxes and inactivity do not count.
Consent must also be as easy to withdraw as to give. The Act requires you to tell people, before they give consent, that they can withdraw it at any time.
Contacts you already have: can you email them?
Existing customers
The Act includes a legitimate interests basis, which some businesses use to send related offers to people who have already bought from them. This requires a balancing test against the individual’s rights, and it is less certain than consent. If you rely on it, make the opt-out prominent from the very first message, and document your reasoning.
Business cards and trade-show leads
A handed-over business card suggests interest in a conversation, not a standing permission to receive newsletters. Send a single, personal follow-up that invites the person to subscribe, rather than adding them to your campaign list automatically.
Bought or borrowed lists
Never. People on a purchased list have not consented to hear from you, and these lists damage sender reputation. See why you should never buy email lists.
How to collect consent that stands up
- Use a clear form. Build a subscription form with an unticked checkbox and one sentence explaining what subscribers will receive and how often.
- Confirm by email. Double opt-in sends a confirmation link. It proves the address belongs to the person and gives you a timestamped record. Our FAQ on the difference between opt-in and double opt-in explains the trade-offs.
- Keep the evidence. Where you rely on consent, the Act says you must be able to demonstrate it. Store the date, the source (website, front desk tablet, event) and the wording shown. If the Commissioner or a customer asks, you can show it.
- Be careful with minors. The Act defines a child as anyone under 18 and sets extra conditions for processing children’s data. Schools, sports clubs and youth programmes should obtain consent from a parent or guardian.
Honouring “stop” requests
The Act gives every person the right to require, by written notice, that you stop processing their data for direct marketing. You must comply at the end of a 21-day period. In practice, an unsubscribe link in every email, handled automatically, meets this right the moment someone clicks. Mailpro removes unsubscribers from future sends automatically and supports the one-click unsubscribe header that Gmail and Yahoo now expect.
Contacts outside Barbados
A guest from London, Toronto or New York who joins your list is protected by their own country’s rules as well. For EU and UK residents, GDPR-level consent is the benchmark. For Canadians, Canada’s anti-spam law requires express or qualifying implied consent. Collecting clear opt-in consent from everyone is the simplest way to satisfy all of them.
Where the consent records live
Consent records are personal data, and the Act restricts transfers outside Barbados to destinations with adequate protection. Mailpro keeps them, with the rest of your account, on Swiss private infrastructure outside US jurisdiction. Mailpro is GDPR-native and never sells or rents your data. For the broader legal context, go back to email marketing law in Barbados.