What is the Difference Between Policy and Law?

There are many differences between a policy and a law:

Laws are external to an organization (e.g., issued by a government), while policies are internal to an organization (e.g., issued by executive leadership);
Laws are statutory, where laws are enforceable by judicial systems and violations can result in penalties such as fines, imprisonment and/or other sanctions; and
Policies are internal documents that establish management’s intent to align behaviors and decisions with business goals, compliance requirements, or risk management strategies.

While policies can be used to implement an organization’s compliance with a law, a policy is not legally enforceable outside the organization.