Form without a privacy notice
Scan rule · RSC-PRV-013
- Privacy (GDPR)
- Severity: Low
Finds forms with an email field that have no reference to the privacy policy nearby.
Why this matters
Article 13 GDPR requires information at the time of collection; for Swiss sites it is Article 19 revFADP, with the GDPR only in addition if EU users are addressed. A form that takes an email address collects personal data, so the notice belongs at the form, not only in the footer.
Deliberately narrow: the rule only fires for forms with an email field and ignores search and filter forms. It checks the area around the form, not the whole page.
Scan tier
- External scan (anonymous)
How to fix it
Add a link to the privacy policy directly at the form.