If you have a data privacy attorney on staff, you should definitely ask him or her to write this up for you. Just as a heads up, if you want to ask your outside attorney to draft these for you, that’s a great idea but it may be a bit pricey. Also, lawyers that do not work in the privacy field often use Termageddon solutions for their Privacy Policies so that’s something to think about as well.
Some of the laws that are being proposed or passed do not limit enforcement and liability to large companies only so your small business could be liable as well. Also, consumers do not distinguish between small and large businesses when it comes to protecting their privacy, and are less likely to buy from companies that do not respect their privacy.