An article explained that “it is not explicitly stated in the GDPR that every data controller must have a written policy. But, depending on your organization and the scale of your processing, it may be helpful to have one. In most cases, it would be a good idea to have one as it helps you to meet your obligations under the law.”