In 2018 the introduction of the GDPR (General Data Protection Regulation) seemed to catch a lot of people out, as if it was a brand-new law that they had never heard of before. Whereas, in reality, the data protection law has been around for a very long time and the GDPR is just an upgrade.
A GDPR compliant Privacy Policy (sometimes referred to as a Privacy Notice), must be provided before or at the time of collecting personal information.
You are legally obliged to have one on your website if your website collects any data through which a person can be identified. This could be as simple as their email address or even their IP address (as this could be static and specific to that person).