Is the default privacy policy updated for the GDPR and can I leave it as is?

I suspect that is the case, yes.