A GDPR policy is required to notify customers of their rights to access their information and make informed consent decisions on how their personal data is used and shared.