Email Marketing Law in Jamaica

Jamaica does not have a stand-alone anti-spam statute. Instead, marketing by email, text message or any other channel is regulated through the Data Protection Act, 2020 (DPA), which was passed in 2020 and became fully enforceable on 1 December 2023 after a transition period. The regulator is the Office of the Information Commissioner (OIC). If your business in Kingston, Montego Bay or anywhere across the 14 parishes keeps a customer list, this law is the one to understand before you press send.

This page gives the big picture. For a direct answer on whether your campaigns are lawful, read are email campaigns legal in Jamaica?, and for the mechanics of consent see permission to send email campaigns. This is general information, not legal advice.

The rule that matters most: section 10

Section 10 of the DPA deals specifically with direct marketing, which the Act defines broadly as approaching someone “by any means of communication (whether electronic or otherwise)” to promote goods or services, or to ask for a donation. That covers newsletters, promotional emails, bulk SMS and fundraising appeals alike. Under section 10 you may send direct marketing only if the person:

• has consented to their data being used for that purpose, or
• is an existing customer whose details you obtained in the course of a sale, you are promoting your own similar goods or services, and they were given a free, simple chance to object when you collected their details and in every message since.

Every marketing message must also identify who sent it (or on whose behalf) and give an address or contact where the recipient can ask for the messages to stop. Two further details are specific to Jamaica: you may not ask a person for marketing consent more than once, and consent requests must follow the form and manner prescribed under the Act, so check the current Data Protection Regulations when you design your sign-up flow.

The eight data protection standards

Beyond section 10, the DPA sets eight standards for all processing of personal data. In a marketing context they translate into practical habits:

• Fair and lawful processing: tell people who you are and what you will send.
• Specified purpose: an email address collected for a hotel booking confirmation is not automatically a newsletter address.
• Adequate, relevant, not excessive: a sign-up form rarely needs more than a name, an email and perhaps a parish or birthday.
• Accuracy and retention limits: clean out bounced and long-inactive contacts rather than keeping them indefinitely.
• Data subjects’ rights: answer access requests (the Act allows thirty days) and act on objections.
• Security: protect the list with appropriate technical and organisational measures.
• Overseas transfers: the eighth standard, covered below.

Registration, data protection officers and breaches

The DPA requires data controllers to register with the OIC, and the government announced a six-month registration grace period when the Act took effect. Certain controllers must also appoint a data protection officer who monitors compliance independently and liaises with the Commissioner. If a security breach affects personal data, the controller must report it to the Commissioner within seventy-two hours of becoming aware of it. The OIC website explains who must register and how; check it for the current fees and deadlines.

Sending your list abroad: the eighth standard

Every cloud email platform involves a transfer, because your contacts are stored on servers somewhere outside Jamaica. Section 31 of the DPA says personal data should not go to a State or territory that does not ensure an adequate level of protection, with exceptions such as consent or safeguards authorised by the Commissioner. The Minister can list adequate countries, and other cases are for the Commissioner to decide.

Mailpro stores data in Switzerland, on private infrastructure outside US jurisdiction. Switzerland has a modern federal data protection law and benefits from an EU adequacy decision, which makes the protection level straightforward to document in your records.

Penalties

The DPA creates a range of offences with fines and, for some, imprisonment, and the OIC can issue enforcement notices. For a company, section 68 allows a court to impose a fine of up to four percent of the business’s annual gross worldwide turnover for the preceding year. Breaching section 10 is expressly treated as a breach of the sixth data protection standard, so unsolicited marketing is not a minor technicality.

Your rights-handling routine

People on your list have rights under the Act that your team should know how to handle. They can ask what personal data you hold about them, and the Act gives you thirty days to respond to an access request. They can have inaccurate data corrected. They can withdraw marketing consent in the same way they gave it, and existing customers can refuse further marketing in any message. A simple internal routine covers most of this:

1. Name one person responsible for data requests and complaints, even in a small business.
2. Keep a log of each request, the date received and the date answered.
3. Make sure unsubscribes from every channel, whether an email link, a text reply, a phone call or a note at the front desk, end up on the same suppression list.
4. Review your privacy notice once a year and whenever you add a new tool, such as an online form or a loyalty app.

How the DPA compares with the GDPR

Jamaica’s Act was drafted with European law in mind, so businesses that already follow the GDPR will recognise much of it: a consent definition built on “informed, specific, unequivocal and freely given”, data protection officers, seventy-two-hour breach reporting, restrictions on overseas transfers and turnover-based fines. The differences are in the details. Jamaica requires registration with the OIC, includes an explicit ask-once rule for marketing consent and sets its own penalty levels in Jamaican dollars and percentages of turnover. If you also mail EU residents, the GDPR applies to them in parallel, not instead of the DPA.

Mailing the diaspora: other laws also apply

Many Jamaican brands, from sauce makers to music promoters and remittance services, market to Jamaicans living abroad. When you do, the recipient’s country adds its own rules:

A practical approach is to meet the strictest rule across your whole list: explicit opt-in, clear sender identity, a physical address and a one-click unsubscribe. Mailpro handles unsubscribes automatically and supports double opt-in, which gives you a dated record of every consent. For advice on your specific situation, speak to a Jamaican attorney.