What are the minimum "legal" and privacy requirements to have in place when sharing a private beta?

We are now in private beta to test the first set up features and was wondering if we already need to have privacy policies and NDAs disclaimers in place. Basically it's a project management tool for creatives to manage the relationship between agency and client. As you can image, there is a lot of confidential information/docs shared between the two. What do you think?