Written by Aisha McKinney, Esq., Principal Attorney & Co-Founder at Zova Law, and Jasmine Johnson Parker, Esq., Co-Founder & Principal Attorney at Zova Law. Quick Answer: A legally compliant small business privacy policy must include five disclosures: (1) what personal data you collect and why, (2) how data is used and shared — including every third-party tool on your website, (3) user rights under applicable state privacy laws, (4) your data retention and deletion policy,