Do you need a privacy policy, and what should it actually say?

Any business collecting personal data — customers, staff, website visitors — needs a clear, accessible privacy notice explaining what's collected, why, how long it's kept, and people's rights over it. Copying a generic template without checking it matches what you actually do can itself become a compliance problem, so review it whenever you start collecting new types of data or using a new tool that processes personal information.

Coach's tip: read your own privacy policy once a year as if you were a customer — if it doesn't match reality, it needs updating, not just existing.