If you have a data privacy attorney on staff, you should definitely ask him or her to write this up for you. Just as a heads up, if you want to ask your outside attorney to draft these for you, that’s a great idea but it may be a bit pricey. Also, lawyers that do not work in the privacy field often use Termageddon solutions for their Privacy Policies so that’s something to think about as well.