EXP: a privacy policy can go into great detail on how an organisation applies data protection principles, what procedures it should follow, assigning individual/departmental responsibilities, etc., and is fundamentally a document for internal reference; despite differences in scope and audience, the terms "privacy policy" and "privacy statement" are frequently used interchangeably