Documents

How long should a policy document be?

A single workplace or customer policy works at 3 to 5 pages and roughly 600 to 1,300 words. Across 27 finished policies measured here, the median is 4 pages and 1,049 words; the privacy policy runs 5 pages and 11 sections, and only a full company information security policy goes past 6 pages.

Indunil Asanka · Co-founder

4 min read · Published 21 October 2026

A single policy document works best at 3 to 5 pages and about 600 to 1,300 words: enough for the purpose, who it covers, the rules, the responsibilities and what happens on a breach. Across the 27 finished policies measured on this site, the median is 4 pages and 1,049 words, and only a 15 page company information security policy runs past 6 pages.

What was measured

The set is the 27 policy and procedure documents in the document example library on this site, measured on 21 October 2026: workplace policies for fictional Australian employers, from a dress code to a whistleblower policy, plus customer facing policies such as privacy and refunds. A script rendered each as A4 pages and counted the pages and the words on them. Most have a cover; the privacy policy and the refund policy do not.

These are examples written to be adopted and adapted, so they show how much a complete policy needs. Policies that follow a law should be checked against that law, not against a length.

Three to five pages for most

Seven policies are 3 pages, the short ones that set one rule: a dress code, a mobile phone policy, a gifts and benefits policy, a cash handling procedure, a bring your own device policy, an onboarding policy and a work health and safety policy statement. They run 575 to 734 words.

Eleven are 4 pages, from 796 to 1,272 words: performance management, equal opportunity, complaints, vehicle use, acceptable use, grievance, expense reimbursement, social media, conflict of interest, recruitment and the disciplinary procedure. These carry a process as well as a rule, such as how a grievance is raised and decided.

Six are 5 pages: anti bullying, the privacy policy, sexual harassment, travel, whistleblower and drug and alcohol, 1,115 to 1,410 words. They deal with sensitive conduct or legal duties and need more on reporting and protection.

The outliers

Information security is the one subject that runs long. The shorter information security policy is 6 pages and 1,742 words, built around a table of controls by risk area. The full company version is 15 pages and 5,274 words, with separate sections on acceptable use, access and passwords, multi factor authentication, devices, phishing, data classification, remote and third party access, and incident reporting. The refund and returns policy is the shortest at 2 pages, because it states customer rights and a process, not staff conduct.

The privacy policy

The privacy policy runs 5 pages and about 1,150 words across 11 section groups, more than any other policy here, because Australian Privacy Principle 1 sets out what it must cover: the kinds of personal information collected, how it is collected and held, the purposes, how people can access and correct it, how to complain and how complaints are handled, and whether it is likely to be disclosed overseas. Each requirement needs its own heading so a reader can find it. The privacy policy against privacy notice page explains the shorter document that sits on a form, and how to write a privacy policy covers the wording.

Setting the length of yours

One rule: 2 to 3 pages, purpose, scope, the rule, breach and review date.
A rule with a process: about 4 pages, adding the steps and who decides.
Sensitive conduct or a legal duty: about 5 pages, adding reporting, protection and support.
Several policies: keep them as separate documents unless they are an onboarding pack.
Clear, descriptive headings, as the Australian Government Style Manual recommends, so a reader can find the part that applies to them.

The employee handbook sections post shows how policies fit into a handbook, and how to write a leave policy works through one policy in full.

In the product

The document generator classifies a policy by register before writing it, and the register steers the theme: legal documents toward Slate, Navy or Midnight, corporate toward Navy, Slate, Ocean or Forest. A cover is added only where a reader would expect one and never under three pages, and the AI chat edits text after generation. The tone and register page shows how register shapes the result, and the guide to layout, spacing and page breaks covers fitting a policy to its pages.

Rendered pages and words of the 27 policy and procedure documents on this site, measured on 21 October 2026. Pages include the cover where there is one.
Policy	Pages	Words
Company information security policy, full version	15	5,274
Information security policy	6	1,742
Drug and alcohol policy	5	1,410
Whistleblower policy	5	1,304
Travel policy	5	1,263
Sexual harassment policy	5	1,190
Privacy policy	5	1,152
Anti bullying policy	5	1,115
Disciplinary procedure	4	1,272
Recruitment policy	4	1,254
Conflict of interest policy	4	1,160
Social media policy	4	1,130
Expense reimbursement, grievance, acceptable use, vehicle use, complaints, equal opportunity and performance policies	4 each	796 to 1,084
WHS policy statement, onboarding, mobile phone, cash handling, gifts and benefits, dress code and BYOD policies	3 each	575 to 734
Refund and returns policy	2	656
All 27 policies	Median 4	Median 1,049

A finished example

A privacy policy is a list of true statements about what a business does with information, and copying a US template produces a list of false ones. This policy is written for an Australian online store to the thirteen privacy principles, with a table of every service that receives customer data and where it is, which is the part most policies skip.

Read the privacy policy template written to the australian privacy principles

Questions people ask

How long should a privacy policy be?

Long enough to cover what Australian Privacy Principle 1 requires: the kinds of information you collect, how you collect and hold it, why, how people can access and correct it, how to complain, and whether it goes overseas. The privacy policy example here does that in 5 pages and about 1,150 words across 11 sections.

Should each policy be a separate document?

Usually, yes. A separate 3 to 5 page policy can be updated, approved and found on its own, and staff read the one they need. The 15 page information security policy in this set shows the cost of the other approach: ten subjects in one document, so a change to one section means reissuing all of it.

What sections does a workplace policy need?

Purpose, who it applies to, the rules or standards, responsibilities, what happens if it is breached, related documents and a review date. The workplace policies here use six to eight section groups, which is about one page each at 3 to 5 pages. A policy without a review date tends to go stale.

Is a one page policy enough?

For a simple customer facing rule, sometimes; none of the policies here is shorter than 2 pages, and the refund and returns policy is the shortest at 2. A one page staff policy usually leaves out the breach process or the responsibilities, which are the parts that matter when the policy is actually used.

How often should policies be reviewed?

Every year or two, and whenever the law or the business changes. Put the review date and the owner on the policy itself so the reader can see whether it is current. Policies that track legislation, such as privacy, work health and safety and whistleblowing, need a check whenever the law they follow is amended.

Written by

Indunil Asanka · Co-founder

Builds the generation pipelines behind OneCraft: the slide, flyer and poster layout engines, the document grid and the render workers that turn a written brief into a finished file.

LinkedIn profile

Sources

Written and checked by the OneCraft team. Last checked 21 October 2026.

Make your own document

Describe what you need and the generator writes and designs it, then you edit anything you like.

See what it can make