In the EU, the GDPR requires a Privacy Policy for businesses that collect or process personal data from EU residents.