Yes. No law in the Federation of Saint Kitts and Nevis bans commercial email. What the law does is set conditions around the personal data you use to send it, and those conditions are tighter than many small businesses in Basseterre or Charlestown assume. The picture is also unusual: the main privacy statute has been passed but, at the time of writing, is still waiting to be switched on.
Please note: this page is general information, not legal advice. Check the current position with a lawyer in St Kitts or Nevis before you rely on it.
The Data Protection Act, 2018
The National Assembly passed the Data Protection Act, 2018 (Act No. 5 of 2018) on 4 May 2018, and it was published in the Official Gazette in June 2018. Section 1 says it comes into force on a day fixed by the Minister by order in the Gazette. As of February 2025, the University of the West Indies Data Protection Office reported that no commencement order had been published. Check the Gazette or the St Kitts and Nevis Law Commission for the latest status before you plan around it.
Even before commencement, the Act is the best guide to where the Federation is heading. Its core rules for any private business that collects email addresses are:
- Consent first (section 7). Personal data may not be processed without the person’s consent, except where processing is needed for a contract, a legal duty, vital interests or similar grounds. Marketing is not on that list of exceptions, so consent is the route for newsletters.
- Notice and choice (section 8). When you ask for someone’s details, you must tell them why, who you may share them with, and how to ask for access or correction.
- Disclosure (section 9). Data may not be passed to other parties or used for unrelated purposes without consent. A guest list shared between two resorts, for example, would need fresh agreement.
- Security (section 10). You must take practical steps to protect data, including looking at where it is stored and making sure any processor you use gives sufficient security guarantees.
- Retention (section 11). Data should be deleted once it is no longer needed for its purpose.
The regulator named in the Act is the Information Commissioner, the officer appointed under the Freedom of Information Act. Section 38 sets out penalties: a body corporate convicted of an offence under the Act faces a fine of up to 250,000 dollars on summary conviction and up to 500,000 dollars on indictment, and officers who authorised the offence can be liable too.
Is there an anti-spam law?
We could not find a dedicated anti-spam statute in St Kitts and Nevis, nothing equivalent to the US CAN-SPAM Act or Canada’s CASL. The Electronic Transactions Act, 2011 lets regulations set standards for how service providers deal with customers who send bulk, unsolicited electronic records, but it does not itself create an opt-in rule for marketers. The Electronic Communications Act, passed in 2021, governs the telecoms sector through the National Telecommunications Regulatory Commission (NTRC) and the regional regulator ECTEL.
So the safe reading is plain: in the Federation, the privacy principles above do the work that an anti-spam law does elsewhere, and Mailpro’s own anti-spam policy applies to every account regardless of country.
The foreign laws that matter more than you think
A resort on Frigate Bay or a villa on Nevis usually mails more people abroad than at home. Those recipients bring their own laws with them:
- North American visitors: CAN-SPAM for US recipients and CASL for Canadians, which requires consent before you send.
- European and British guests, and Citizenship by Investment applicants living in Europe: the GDPR and its British equivalent can apply when you offer services to people there. Mailpro’s note on GDPR for companies outside Europe explains when.
What this means in practice
Build your list with clear, recorded consent; say on the form what you will send and how often; put a working unsubscribe link in every message; and keep the list clean. That approach satisfies the Data Protection Act’s principles today and holds up under CASL, CAN-SPAM and the GDPR tomorrow. For a step-by-step version, read how to get permission to send email in St Kitts and Nevis, or go back to the overview of email marketing law for the Federation.