Saint Lucia’s rules for email marketing are short on specific statutes and long on practical consequences. There is a data protection law, partly in force since 2023, and there is no dedicated anti-spam act. Because so many Saint Lucian businesses sell to visitors, the stricter rules of the United States, Canada, the United Kingdom and the European Union often decide what a compliant campaign looks like. This guide sets out the whole picture. It is general information, not legal advice, and a local attorney should confirm anything you plan to rely on.
The four sources of rules
1. The Data Protection Act 2011 (Cap. 8.18)
The Act governs how personal data, including names, email addresses and phone numbers, is collected, used, stored and shared. It creates a Data Protection Commissioner and a register of data controllers. The Act only takes effect by ministerial order, and a Proclamation Order effective at the end of January 2023 brought in part of it, notably the registration duty and parts of the data-protection principles. Enforcement powers and most individual rights were reported as still awaiting commencement. Our page Is email marketing legal in Saint Lucia? explains what that split means day to day.
2. No specific anti-spam statute
We found no Saint Lucian law that sets opt-in rules for commercial email or SMS. The Electronic Transactions Act 2011 deals with the validity of electronic records and contracts. The NTRC regulates telecoms operators, with ECTEL as the regional authority for the Eastern Caribbean. None of these creates a marketing consent regime. That gap is not a licence to buy lists: mailbox providers such as Gmail and Outlook apply their own rules, and unsolicited mail from a Saint Lucian domain lands in spam folders just as fast as anyone else’s. See why you should never buy email lists.
3. Your subscribers’ home laws
A villa in Soufrière mailing past guests in New York, Toronto, London and Paris is sending into four legal systems. CAN-SPAM requires honest headers and a working opt-out for US recipients; Canada’s CASL requires consent and identification; the GDPR and UK GDPR require a lawful basis and transparency for people in Europe. Building to the strictest of these once is simpler than running four processes.
4. Mailbox-provider rules
Since 2024 Gmail and Yahoo have required bulk senders to authenticate their domain, keep complaint rates low and offer one-click unsubscribe. These are technical rules, not laws, but they decide whether your message is seen. Mailpro’s summary of the Gmail and Yahoo requirements covers what to set up.
What the Data Protection Act asks of marketers
- Fair collection: tell people who you are and what you will send when they sign up, whether that is a booking form, a Rodney Bay restaurant loyalty card or a festival ticket page.
- Purpose limitation: an address given for a booking confirmation is not automatically an address for promotions. Ask separately.
- Accuracy and retention: clean bounces and long-inactive contacts, and do not keep data forever.
- Security: use a provider with encryption in transit (Mailpro uses TLS 1.3) and access controls.
- Direct-marketing objections: the Act lets individuals require you to stop direct marketing. Build the habit now; Mailpro handles unsubscribes automatically.
Sending data abroad
Almost every email platform stores data outside Saint Lucia, so the Act’s transfer rule is relevant to every sender. It restricts transferring personal data to a country that does not ensure an adequate level of protection, subject to exceptions such as the individual’s consent. The Act does not, as far as we could find, publish a list of adequate countries. Documenting why your provider’s location is safe is therefore sensible. Mailpro stores data in Switzerland on private infrastructure, outside US jurisdiction, and Switzerland holds an EU adequacy decision. More on this in why Switzerland.
SMS is covered by the same logic
Text messages to +1-758 numbers are personal data processing under the Act, and there is no separate SMS marketing statute that we could identify. Get consent at the point you collect the number, identify your business in the message and include a way to stop. Our FAQ on SMS laws and restrictions covers general good practice.
A compliance checklist for Saint Lucian senders
| Area | What to do |
|---|---|
| Registration | Check whether you must register as a data controller with the Commissioner |
| Collection | Explain on every form who you are and what you will send |
| Consent | Use unticked boxes; use double opt-in for international lists |
| Identification | Show your business name and a physical address in every email |
| Opt-out | Include an unsubscribe link and honour it immediately |
| Security | Limit access to contact lists; use encrypted services |
| Transfers | Document where your provider stores data and why it is adequate |
| Retention | Remove contacts who no longer engage or have asked to leave |
Sector notes
Tourism: separate booking communications from marketing, and ask for marketing consent at booking or check-in. Citizenship by Investment and financial services: prospects are international and often in Europe, so plan for GDPR-level consent and careful data handling. Retail: loyalty programmes are a natural point to ask for email and SMS consent. NGOs and churches: supporters expect news, but still offer an easy way out.
Common questions from Saint Lucian businesses
Can I email people whose card I collected at a trade show?
If they handed you a card to be contacted about your business, a relevant follow-up is reasonable locally. Adding them to a monthly promotional newsletter is a different purpose; ask first. If they live in Canada or the EU, assume you need their consent.
Do I need a privacy notice?
The Act’s fairness principle means people should know who holds their data and why. A short privacy notice linked from every sign-up form is the practical way to show that.
Does the law apply to government-linked bodies and NGOs?
The Act applies to data controllers generally, subject to its exemptions. Tourism promotion bodies, schools and non-profits that email supporters should follow the same principles as businesses.
What if a guest complains?
Remove the address immediately, check how it was collected, and fix the source. Until the Commissioner’s enforcement powers are commenced, the more immediate cost of complaints is deliverability: providers block senders whose mail is reported as spam.
Next steps
Read how to collect valid permission from Saint Lucian and international subscribers, then put it into practice with a compliant subscription form.