Scan rule · RSC-PRV-013
Form without a privacy notice
Privacy (GDPR)Severity: Low
Finds forms with an email field that have no reference to the privacy policy nearby.
Why this matters
Article 13 GDPR requires information at the time of collection. A form that takes an email address collects personal data, so the notice belongs at the form, not only in the footer.
Deliberately narrow: the rule only fires for forms with an email field and ignores search and filter forms. It checks the area around the form, not the whole page.
Scan tier
External scan (anonymous)
How to fix it
Add a link to the privacy policy directly at the form.