If your organisation processes personal data, it should consider its obligations under the applicable data-protection framework. A privacy notice should explain, among other things, what information is collected, why it is used and relevant rights and contact information.

Do not copy a generic privacy policy without checking your actual data practices. The notice should reflect what your business really collects, how it uses the information, who receives it and how long it keeps it.

Yes, this is something the business should take seriously. The exact requirements depend on the nature and scale of the processing, so the policy should be tailored to the business.