Processing of personal data

We respect everyone’s right to the protection of their personal data, which is why we process personal data based on your (data subject’s - identified or identifiable natural person) interests, rights, and freedoms. This website provides an overview of the principles of personal data processing in the Education and Youth Authority.

Personal data and personal data processor

Personal data is any data that allows a person to be identified. The processing of personal data is an act performed on personal data.

The chief data processor is the Education and Youth Board (hereinafter Harno).

We guarantee the integrity, availability, and confidentiality of your personal data through organizational, physical, and IT security measures (such as employee data protection training, restrictions on access to our information systems, building security measures).

If we process data as an authorized processor, we do so according to the instructions of the controller (e.g., when processing personal data in national databases).

References and contacts

Our contact details
Public Information Act
Administration system for the state information system RIHA
Estonian Data Protection Inspectorate:

You can always contact our data protection specialist at for questions related to data protection or to exercise your rights.

Purpose of the processing of personal data

We process personal data during the implementation of education and youth policy and activities that support the operation of Harno (e.g., accounting, personnel management, conducting procurement procedures, etc.).

The composition of personal data (e.g., personally identifiable information, contact information, health data, etc.) depends on the specific service, but we always consider the principle of minimization, i.e., we collect only the personal data that is necessary to provide our services.

Legal basis for the processing of personal data

We process personal data only on the grounds permitted by law: for the performance of a public task, performance of a contract, performance of a legal obligation, with your consent, preparation, submission and protection of a legal claim, protection of your or another person’s vital interests, or, in the absence of a principal task, on the basis of a legitimate interest.

We process personal data on the basis of consent only if there are no other grounds specified in legislation and you have given unambiguous consent to the processing of your data. The consent must state the specific purpose of the processing of personal data and the data processor (Harno and, if necessary, the co-responsible processor). We ask for consent in such a way that it is clearly distinguished from other questions and formulated in such a way that it can be proved later (e.g., in a signed statement, e-mail, SMS). You have the right to withdraw your consent at any time by notifying us of your wish. Withdrawal of consent shall not affect the admissibility of processing prior to withdrawal.

For the processing of special types of personal data (e.g., health data), we ask for explicit consent, or we process special types of personal data for employment law obligations and special rights (e.g., in relation to occupational health) or for important public interest reasons (e.g., scholarships for students with special needs).

Transfer of personal data to third parties

We may transfer personal data to third parties who have the right to do so by law, regulation, or international agreement or who cooperate with us (e.g., as part of a service provided to Harno). Our partners process personal data on Harno’s behalf and only for the purpose for which Harno processes the personal data collected and in accordance with the terms of our processing of personal data. We may also transfer personal data to the competent governmental authorities for the purpose of fulfilling a legal obligation.

Our partners may be located outside the scope of the General Data Protection Regulation (GDPR), i.e., outside the European Union and its economic area (e.g., if you take a foreign language proficiency test). In this case, we will implement safeguards to ensure the protection of personal data in accordance with the General Regulation.

Processing of personal data in the public document register

The Authority is a state agency, and our activities are public. The website of the Authority has a public document register where you can get acquainted with the documents that arise in the course of our activities. These documents may also contain personal data. As a rule, information containing the privacy of your personal life is protected by access restrictions. Possible grounds for access restrictions are set out in the Public Information Act.

We strive to ensure that your privacy is infringed as little as possible. If you correspond with us as an individual, your name will be visible as initials. If someone wishes to inspect your correspondence and submits a request for information to us, upon receipt of the request for information, we will review whether the person requesting the information has the right to see the requested document by law. We only provide information related to you to institutions and persons who have the right to do so by law (e.g., pre-trial proceedings, court) and a justified need.  

Processing of personal data of a person applying for a job at Harno

At Harno’s personnel competitions, we proceed from the information provided by the candidates. In addition, we may collect information about candidates from public sources. When collecting information from public sources, the candidate has the right to examine the collected information and submit his or her explanations and objections.

Only employees involved in the recruitment process will have access to the information obtained through the staff competition.

If a candidate submits the details of his/her referrers when applying, we assume that it is not necessary to ask for separate consent to contact them, and the referrers have given their consent that a representative of the Authority may contact them for information about the candidate.

We may keep the data of unsuccessful candidates for one year in order to resolve possible legal disputes; we may keep the data longer on the consent of the candidate (e.g., to be invited to participate in a future competition).

Processing of personal data in the information systems of the Authority

Harno manages several sectoral information systems. The principles for the processing of personal data related to these information systems may be reflected in terms of use of a specific information system and in the statutes of the information system, or a detailed description of the data processed in information systems can be found on the State Information System Administration (RIHA) website.

Time limits for the storage of personal data

We store personal data for the period necessary to achieve the purposes of processing or until the storage period provided by law (e.g., accounting data for seven years). The terms of personal data retention are confirmed in the Harno information asset classification scheme; in addition, the terms of data retention may be included in other Harno internal procedures. At the end of the storage period, the data will be anonymized or deleted unless there is a circumstance that precludes the deletion of personal data, such as an ongoing legal dispute.

Your rights as a data subject

You have the right to inspect your data at any time and to be informed of the purposes and deadlines for processing the data. To get acquainted with the data, please contact us at the contacts provided on this website or, if the data is in the information system to which you have access, by examining the data in the information system.

You have the right to request the correction of your personal data if you have discovered incorrect data by consulting the data. To do this, you must contact us or, if the personal data is in the information system, you can request a correction or, if possible, correct the data in the information system yourself.

You have the right to request the deletion of your data, i.e., the right to be forgotten if your personal data is processed with consent. However, complete deletion of personal data is not possible if the personal data are also processed for other purposes and bases (e.g., personal data are used to fulfill legal obligations when submitted to public authorities or to keep accounting documents or to prepare a legal claim on a contractual basis).

You have the right to object to the processing of personal data at any time. Upon receipt of the objection, we will consider the legal interests and, if necessary, terminate the data processing. The right to object cannot be exercised if we prove that personal data are processed for a valid legitimate reason, which outweighs the interests, rights, and freedoms of the data subject or for the purpose of drawing up, submitting, and defending legal claims.

You have the right to restrict the processing of data about you if a) you have challenged the accuracy of the personal data and the processing is restricted for the time of the data being checked, or b) you request a restriction on use instead of deletion in case of unlawful processing, or (c) if Harno no longer needs the data, but you need it to draw up, submit or defend a legal claim; or (d) if you object, the period within which Harno will take a decision on the lawfulness of the processing.

You have the right to require us to transfer data submitted in a structured, publicly available format and in a machine-readable manner to another controller if the data is processed automatically and with the consent of the data subject or the performance of a contract. In complying with the requirement, Harno must also assess that the exercise of the right would not prejudice the rights and freedoms of other persons.

To exercise your rights, please contact us at In order to issue, correct, or delete data or respond to objections, we need to identify the requester, so we may ask you for a formal application, including a digitally signed one, or other means of identification. We will reply to you without undue delay, but no later than one month after receiving the request. The time limit for reply may be extended by two months, taking into account the complexity of the request and the volume of data. We will notify you of the extension within one month of receiving your request.

Submission of inquiries and right of appeal

You can always contact our data protection specialist with questions related to the processing of your personal data or to exercise your rights at the e-mail address You also have the right to lodge a complaint with the Data Protection Inspectorate or a court at any time.

Last updated: 10.11.2021