A privacy policy is a legal requirement if your site collects personal information or data from its users. Personal information is any data that can identify a site user. A privacy policy is required under privacy law for online businesses worldwide. Not every site needs a privacy policy, only those that collect personal information—for example, an email address. You can check the types of information that are included under GDPR for guidelines. It is good legal advice to include a privacy policy even if you do not think your site collects any private user data. As a small business, it is easier to generate GDPR compliant privacy policy information than face the repercussions if you are mistaken.