Email Marketing Law in St Kitts and Nevis

Ask five business owners in Basseterre what the law says about newsletters and you will likely get five answers. That is understandable. St Kitts and Nevis has a modern privacy statute on its books, but it has not yet been brought into force, and there is no stand-alone anti-spam act. This guide sets out what exists, what is still pending, and a compliance approach that works for a two-island market that sells mostly to visitors, investors and students from overseas.

Please note: this is general information, not legal advice. Laws and their commencement status change, so confirm the position with a local attorney.

1. The legislation at a glance

2. What the Data Protection Act expects of a marketer

The Act is built around a set of principles rather than a list of marketing rules. For an email list, they boil down to this:

• Get consent. Section 7 makes consent the general basis for processing personal data. Newsletters and promotions do not fit the contract or legal-duty exceptions, so ask first.
• Tell people what you are doing. Section 8 requires you to explain the purpose of collection, who the data may be shared with, and how people can ask for access or correction.
• Don’t repurpose or pass it on. Section 9 limits disclosure to the purpose stated at collection. An email address given for a booking confirmation is not automatically consent to a monthly promotion.
• Protect it wherever it sits. Section 10 asks you to consider where data is stored and to make sure any data processor, such as your email platform, gives sufficient security guarantees.
• Don’t keep it forever. Section 11 requires deletion once data is no longer needed.

The Information Commissioner, appointed under the Freedom of Information Act, is the regulator named in the Act. Once in force, offences carry fines of up to 500,000 dollars on indictment for a body corporate under section 38, with personal liability for officers who authorised the breach.

What the Act does not say

It is just as useful to know the gaps. Unlike the GDPR, the Federation’s Act has no dedicated section on direct marketing, no separate soft opt-in for existing customers and no specific rules on cookies or tracking pixels. It also has no stand-alone chapter on transfers of data to other countries. Don’t read those gaps as permission. The general consent principle covers marketing use, and the security principle covers where data is kept. Until regulations or guidance from the Information Commissioner fill in the detail, the cautious course is to follow the principles closely and to adopt the stricter rules of your recipients’ countries where they apply.

Nevis and St Kitts: one law for both islands

The Data Protection Act is federal legislation, passed by the National Assembly, so it applies to businesses on both islands. The Nevis Island Administration has its own responsibilities, and Nevis has its own legislation for its international financial services sector. If you operate a Nevis-registered company or trust business, check with your registered agent whether sector-specific confidentiality rules affect how you use client contact details for marketing.

3. Where your data lives

The Act does not contain a separate chapter on sending data abroad, but section 10 explicitly lists the place where data is stored as a security factor. That matters because almost every email platform used in the Federation hosts data outside it. Mailpro stores contact data in Switzerland on private infrastructure, outside US jurisdiction and therefore outside the reach of laws such as the US CLOUD Act. Switzerland also holds an EU adequacy decision, which helps if some of your contacts are European. More on the reasoning at why Switzerland.

4. Your recipients’ laws travel with them

A Nevis boutique hotel, a Citizenship by Investment agent in Basseterre and a vet-school supplier near Ross University all have one thing in common: many of their contacts live abroad. When you email them, their home rules can apply alongside local law:

• Americans: the CAN-SPAM Act, which requires honest headers, a physical address and a working opt-out.
• Canadians: Canada’s anti-spam legislation, which requires consent before sending.
• Europeans and British residents: the GDPR and its British counterpart. See how Mailpro supports GDPR compliance.

5. A compliance routine that fits a small market

1. Collect addresses only through forms that say what you will send, ideally with double opt-in confirmation.
2. Store the date and source of each consent, especially for guests who sign up at check-in or at a Sugar Mas event.
3. Put an unsubscribe link in every campaign and honour it immediately; Mailpro handles this through automatic unsubscribe management.
4. Never buy or borrow lists, even from a partner property on the other island.
5. Review and prune inactive contacts at least once a year.

Questions businesses in the Federation often ask

Can I email customers who bought from me before?

The Act does not contain an existing-customer exemption. A customer who gave you their address for a receipt has not necessarily agreed to marketing. Ask them, at the point of sale or in a one-off email that explains what you plan to send.

Do I need consent for booking confirmations?

No. Emails needed to perform a contract, such as confirmations, invoices and service notices, fall under a separate ground in section 7. Keep them free of promotions so they stay in that category.

What if the Act comes into force next month?

If you already collect consent properly, explain your purposes and protect your data, very little will change. That is the main reason to comply with its principles now rather than wait for the commencement order.

For the detail on consent wording and record-keeping, read getting permission to send email campaigns. If your question is simply whether campaigns are allowed at all, the short answer is on is email marketing legal in St Kitts and Nevis.