Policy-based privacy protection in open decentralized information systems such as the Web attracted a lot of research effort in the last years. Policies provide a flexible means to define access control conditions, to realize advanced trust-establishment techniques, and to describe and guide the behaviour of systems. The change in the use of the Web and its movement from a static information system to a user generated, highly dynamic environment requires policy-based techniques to keep step. New requirements to policy specification and reasoning are set up because, on the one hand, users expose more and more personal data and, on the other hand, the role of the Web as a communication platform gained momentum yielding an increasing dynamicy. In this thesis, the limitations of nowadays' policy frameworks are analyzed towards two fundamental principles, the specification of preferences and the representation of reactive behaviour. Based on these observations two new approaches for policy representation and reasoning are introduced, namely preference-enabled policies and reactive policies.