what are the consequences of an organization not having an information policy?
Not having the policy may cause individuals and other businesses to avoid dealing with the organisation, incur penalties from data security regulators and damage the credibility and reputation of the operator.