Following are the basic things you should consider. But if you want to create a comprehensive one, it’s good to meet an IT lawyer.
Specially it’s good, if you do business internationally. European data protection laws are tough and you need to focus on data protection policy too.