Many businesses have legal obligations to disclose their personal-information practices. The answer depends on the data, users, business activities, and jurisdictions involved. A policy should describe the actual practices of the business, including the tools and service providers supporting its website or app.
Health, financial, and children’s information can raise additional requirements. International operations may also matter. For example, the GDPR’s reach is not based simply on a user’s citizenship; establishment, offering goods or services to people in the EU, and monitoring their behavior can affect applicability.
Posting a policy is one part of privacy work. The business also needs to consider whether its collection, use, sharing, security practices, and handling of requests align with its disclosures and applicable obligations.