Yes, if your website collects any type of personal data, you need a privacy policy—even if you're only a small business.