Scan rule · RSC-PRV-013
Form without a privacy notice
Privacy (GDPR)Severity: Low
Finds forms with an email field that have no reference to the privacy policy nearby.
Why this matters
Article 13 GDPR requires information at the time of collection; for Swiss sites it is Article 19 revFADP, with the GDPR only in addition if EU users are addressed. A form that takes an email address collects personal data, so the notice belongs at the form, not only in the footer.
Deliberately narrow: the rule only fires for forms with an email field and ignores search and filter forms. It checks the area around the form, not the whole page.
Scan tier
External scan (anonymous)
How to fix it
Add a link to the privacy policy directly at the form.