Short answer: yes. Belize has no law that bans commercial email, and there is no Belize equivalent of the US CAN-SPAM Act or Canada’s CASL. What Belize does have is the Data Protection Act, 2021 (Act No. 45 of 2021), a GDPR-style privacy law that covers how you collect and use the personal data behind every email address on your list. This page explains what that means for a hotel on Ambergris Caye, a shop in Belize City or an online business in Belmopan.
This is general information, not legal advice. For decisions about your own business, speak to a Belizean attorney.
The law that matters: Data Protection Act, 2021
The Act received assent on 29 November 2021. It covers data controllers established in Belize and also foreign businesses that process the data of people in Belize when offering them goods or services (section 3). An email address linked to a named person is personal data, so building and mailing a list counts as processing.
A point to check before you rely on any of this: section 97 says the Act comes into force on a day the Minister appoints by Order in the Gazette, and different parts can start on different days. Published summaries do not agree on how far the Act has been brought into force, or on how active the Data Protection Commissioner’s office is. Check the current position with the Ministry responsible for e-governance or your lawyer. In practice, running your list as if the Act fully applies costs little and protects you either way.
Direct marketing: the section every sender should read
Section 18 gives any individual the right to tell a business, in writing, to stop using their personal data for direct marketing. The business must stop by the end of a 21-day period. If it does not, the individual can ask the Supreme Court to order compliance. The Act defines direct marketing broadly as sending advertising or marketing material to particular individuals “by whatever means”. That covers email and SMS.
Your unsubscribe link is how you meet this duty in practice. With Mailpro, a click on unsubscribe takes the contact off your list at once. That is far quicker than 21 days.
Consent is defined the GDPR way
The Act defines consent as a “freely given, specific, informed and unambiguous” indication, given by a statement or a clear affirmative action. A pre-ticked box or a business card dropped in a bowl at a trade fair is weak evidence under that wording. An unticked checkbox on a sign-up form, ideally confirmed by double opt-in, gives you a clear record.
Who is exempt, and who is not
Belize’s Act has an unusual feature: small businesses are largely exempt. A “small business” is one whose turnover in the previous financial year was BZ$3,000,000 or less. The exemption does not apply to businesses that provide health services, trade in personal information, run credit reporting or tenancy databases, or are reporting entities under the anti-money-laundering law. Many banks, insurers and offshore service providers fall into that last group. A small business can also choose to opt in.
The exemption is narrower than it looks for anyone who markets to visitors. A resort that emails past guests in Texas, Ontario or Germany is also subject to those guests’ laws: CAN-SPAM in the US, CASL in Canada (which requires consent), and the GDPR for EU residents.
Penalties under the Act
- Breaching the data protection principles (section 5): on summary conviction, a fine of BZ$500,000, up to three years’ imprisonment, or both.
- Ignoring an enforcement or information notice from the Commissioner (section 81): a fine of BZ$5,000.
- Knowingly or recklessly giving false information in reply to an information notice: a fine of BZ$20,000.
The Act also requires businesses to notify the Commissioner of a personal data breach within 72 hours of becoming aware of it.
Selling online? The Electronic Transactions Act applies too
If your emails sell goods or services, section 49 of the Electronic Transactions Act, 2021 requires you to give your legal name, a physical address and an electronic contact method, together with a clear description of what you sell and its payment, cancellation and refund terms. Putting your business details in every email footer and linking to your terms covers this. The Act does not contain a specific anti-spam rule.
What about data sent outside Belize?
Part IV of the Act requires an adequate level of protection and appropriate safeguards when personal data leaves Belize. Section 23(2) expressly allows transfers for cloud storage without the individual’s consent. Mailpro keeps your contact data in Switzerland, on its own infrastructure and outside US jurisdiction. Switzerland’s privacy law is recognised by the EU through an adequacy decision, which helps if you ever need to show the “adequate protection” that section 24 asks about. For details, see why Switzerland.
A practical checklist for Belize senders
- Collect addresses with a clear, unticked opt-in and say what you will send.
- Keep the date, time and source of every signup.
- Include a one-click unsubscribe and honour written stop requests promptly.
- Show your business name, address and contact details in every email.
- Apply the stricter rule when your list includes US, Canadian or European contacts.
For the consent side in more detail, read our guide to getting permission to email people in Belize.