Kinda depends on the size of the organisation, the market(s) in which it is active, the regulations under which it operates, and the reasons for wishing not to have a policy. Since it’s pretty easy to set up a standard policy wording, it would seem most sensible to do so. Not having the policy may cause individuals and other businesses to avoid dealing with the organisation, incur penalties from data security regulators and damage the credibility and reputation of the operator.
If we’re talking about a small dog-grooming co-operative these might not be issues. If you’re something else seeking government contracts, then it becomes important!
