Does every business need a privacy policy?

There is no universal rule requiring every business to publish the same type of privacy policy. Requirements depend on applicable laws, such as the GDPR, and how the business collects, uses, stores, or shares personal information.

Many businesses may need privacy notices even without a website. Customer records, employee files, supplier contacts, CCTV, appointment records, and other business activities can involve personal data. Operating offline, serving only other businesses, or being a small business does not automatically remove privacy obligations.

Different groups may need different privacy information. A customer-facing privacy notice may not adequately explain how employee or applicant data is processed, making separate employee or recruitment privacy notices appropriate where required.

Privacy information can be provided through suitable online or offline channels. The important point is that relevant people receive accessible, understandable information about how their personal information is processed.

A business may therefore need one general privacy policy, several privacy notices, or other privacy information depending on its activities and the laws that apply.