Forms collect or send what the policy does not mention

Checks

• Form sends data to unnamed third party form_posts_to_unnamed_third_party
• Sensitive field not covered by policy sensitive_field_not_covered_by_policy
• Claims no sharing but posts to third party we_never_share_claim_but_third_party_target
• Marketing consent box pre-ticked marketing_consent_pre_ticked
• Form lacks policy link while others have one form_without_policy_link_while_others_have_one
• Different consent wording on similar forms different_consent_wording_on_similar_forms

Findings

• Forms collect or send data in a way the policy and the form wording do not cover
• A form asks for sensitive data that the privacy policy was read as not covering

What this relies on

The policy states the intent; the form tool was embedded without review.

How to verify by hand

The data protection officer.