1. General provisions

1.1 The purpose of the Recruitment Rules is to ensure a transparent and fair recruitment process that offers candidates a positive experience, ensures equal treatment and proper processing of personal data.

1.2 All provisions of these Rules apply to the filling of non-academic positions and the conclusion of contracts with visiting staff. The procedure for filling academic positions is set out in the Academic Career Regulations, but Annex 1 “Principles of Background Checks”, Annex 2 “Processing of Personal Data during the Job Application and Recruitment Process” and Annex 3 “Principles of Equal Treatment in the Recruitment Process” to these Rules also apply to this process.

2. Roles and responsibilities

2.1 The hiring manager (the head of the unit or the immediate superior) shall set out the responsibilities of the position, the requirements for candidates and the selection criteria. The hiring manager shall make the final selection from among the candidates, send the job offer and negotiate the terms of the employment contract with the selected candidate.

2.2 The recruitment specialist in the Human Resources Office (hereinafter referred to as the recruitment specialist) shall prepare and publish the job advertisement, coordinate communication with candidates, ensure that recruitment procedures are properly followed and provide feedback to unsuccessful candidates.

2.3 An external partner engaged to conduct a targeted search shall comply with the terms of the contract concluded with that partner. The recruitment specialist shall arrange the contract with the external partner and manage cooperation with that partner. The costs shall be borne by the hiring unit.

2.4 The hiring manager may involve experts and colleagues at various stages of the recruitment process.

2.5 All persons involved in recruitment shall comply with the requirements set out in the annexes to these Rules, including where no recruitment specialist is involved.

3. Job description and job offer

3.1 The purpose of a job description is to specify as precisely as possible the duties, responsibilities, rights and working conditions of the position, as well as the knowledge, skills and personal qualities required of a suitable candidate. A job description shall include:
3.1.1 the job title, the position within the organisational structure and the immediate superior;
3.1.2 the purpose of the position and its main duties;
3.1.3 the responsibilities associated with the position;
3.1.4 the level of background checks required for the position, determined with the assistance of the recruitment specialist where necessary;
3.1.5 the decision-making authority and rights associated with the position;
3.1.6 the skills required for the position (professional skills, language proficiency, digital competence, etc.);
3.1.7 where applicable, requirements concerning working arrangements (flexible working hours, remote working options, etc.);
3.1.8 the required level of education and previous experience of the person appointed to the position;
3.1.9 the expected salary range for the position;
3.1.10 the preferred employment start date.

3.2 A job offer to the selected candidate shall include at least the following:
3.2.1 the job title;
3.2.2 a description of the duties and scope of responsibility;
3.2.3 the employment start date, place of work, working hours and remote working arrangements;
3.2.4 the workload, salary rate and details of the immediate superior.

4. Candidate search methods

4.1 Competition
4.1.1 Internal competition. The vacancy announcement shall be published on the intranet and in the newsletter, stating that applications are open only to university employees. The application period shall be at least two weeks.
4.1.2 Open competition. The vacancy announcement shall be published on the intranet, in the vacancies section of the university’s public website, on selected job portals, in traditional media or on social media channels. The application period shall be at least two weeks.
4.1.3 In accordance with good practice, university employees should inform their immediate superior when applying for another position. Before negotiations on the employment contract begin, the recruitment specialist or hiring manager shall notify the employee’s immediate superior that the employee has reached the final round of the competition.

4.2 Targeted recruitment
4.2.1 Inviting a university employee to apply.
4.2.1.1 The manager shall propose a change of position to an employee within their own unit and, where necessary, arrange the employee’s transfer to the new position.
4.2.1.2 An employee of another structural unit may be invited, through a targeted search, to apply for or take up another position. Before an agreement on a transfer to another position is concluded, the employee’s current immediate superior shall be informed if the employee has reached the final selection stage or the parties have begun substantive negotiations on the terms of the employment contract. The remuneration offered for the new position shall be commensurate with the duties, responsibilities and competencies required, taking into account labour market conditions, the unit’s available budget and the university’s remuneration principles. Higher remuneration may be offered where justified by the factors listed above, but shall not be used solely to encourage an employee of another structural unit to transfer to an equivalent position.
4.2.1.3 Where an employee transfers to another position, the hiring manager shall agree on the transfer date with the head of the employee’s structural unit, involving the employee where necessary. The hiring manager shall arrange the employee’s transfer to the new position.
4.2.2 External targeted search
4.2.2.1 An external targeted search conducted with the assistance of the Human Resources Office. Based on the job description, the recruitment specialist shall search public sources for individuals who are likely to meet the qualification requirements and hold similar positions.
4.2.2.2 An external targeted search conducted with the assistance of an external partner. The recruitment specialist shall assist in concluding a contract with a company providing targeted search services, in accordance with the Procurement Rules. The hiring unit shall sign the contract and pay for the services purchased. The recruitment specialist shall organise the recruitment process in collaboration with the external partner engaged to conduct the targeted search.

5. Stages and methods of candidate selection

5.1 Shortlisting

Based on the assessments of the hiring manager and the recruitment specialist, candidates whose profiles best match the job description shall be selected from among applicants and individuals identified through a targeted search to proceed to the next stage of the selection process.

5.2 Interviews

Multiple rounds of interviews may be conducted where necessary to determine which candidates will proceed to the final round. The recruitment specialist and the hiring manager shall jointly decide who will participate in the selection process.

5.3 Practical assignments

Candidates may be asked to complete practical assignments, such as a test assignment, a task, a job-specific test or a similar assessment, to verify their competencies. Practical assignments must assess the knowledge, skills and experience required for the position and be reasonable in scope.

5.4 Personality tests

Personality tests shall be conducted by a service provider. The recruitment specialist shall arrange for the conclusion of a contract with the service provider and coordinate the testing of candidates and the provision of feedback. The hiring unit shall sign the contract with the service provider and pay for the service.

5.5 Candidates who reach the final round shall meet with their prospective colleagues in the unit.

5.6 The selected candidate shall undergo a background check in accordance with Annex 1 to these Rules.

5.7 The terms of the contract shall be agreed with the selected candidate.

6. Treatment of candidates

6.1 Candidates shall be kept informed at all times of their current stage in the recruitment process, the next step and its expected timeframe, and whom to contact for further information.

6.2 The following notification deadlines shall apply:
6.2.1 receipt of the application shall be confirmed to the applicant within three working days;
6.2.2 all candidates shall be informed of the outcome of the shortlisting process within 30 days of the application deadline;
6.2.3 candidates who participated in the selection process shall be notified of the selection decision no later than three working days after an agreement has been reached with the selected candidate.

6.3 Interview invitations shall specify the topics to be discussed, who will attend the interview, and its scheduled time and expected duration.

6.4 Rejection notifications shall be courteous and unambiguous. Candidates who reach the final round shall also receive substantive feedback when notified of their rejection.

7. Description of the recruitment process

7.1 Organisation of the competition

7.2 Conducting targeted recruitment

Annexes

Annex 1 “Principles of Background Checks”
Annex 2 “Processing of Personal Data during the Job Application and Recruitment Process”
Annex 3 “Principles of Equal Treatment in the Recruitment Process”

Annex 1
PRINCIPLES OF BACKGROUND CHECKS (entry into force 01.04.2027)

1. Purpose

Background checks are part of the university’s recruitment and human resource management process, promoting risk-conscious management practices, providing a trustworthy working environment, and ensuring compliance with information security and data protection requirements. Background checks are conducted according to the risk level of the position. Background checks are conducted in accordance with the principles of risk-based assessment and proportionality, ensuring that the scope of each check is commensurate with the risk level of the position and that only necessary information is processed in accordance with Annex 2 to these Rules, “Processing of Personal Data during the Job Application and Recruitment Process”. The same requirements shall apply to positions with the same risk level, and the entire process shall be documented and traceable.

Access to information collected during background checks shall be granted only where necessary for the performance of work duties, and its confidentiality shall be ensured.

2. Scope of application

This background check procedure shall apply to persons with whom the university enters into an employment contract or any other contract granting access to the university’s information assets, information systems, premises, or management and decision-making processes.

Background checks shall be conducted before signing the contract on which the employment relationship is based and, where necessary, when a transfer to another position or role entails an increase in risk level.

The procedure shall apply, among others, to:

• • academic and non-academic staff;
• • persons appointed to management roles;
• • temporary staff and interns;
• • persons providing services under a contract for services or an authorisation agreement;
• • representatives of third parties who are granted permanent access to the university’s resources or access requiring a high level of trust.

This procedure does not govern security checks relating to the processing of state secrets or classified foreign information, or other special checks required by law that fall within the competence of the relevant state authorities.

3. Background check levels

The university applies three levels of background checks:

• • Level 1 – Basic background check;
• • Level 2 – Extended background check;
• • Level 3 – Background check for high-trust positions.

3.1 Level 1 – Basic background check

Level 1 shall apply to candidates, position holders, employees and persons engaged under contract who are granted standard access rights necessary for their work and have no privileged access to critical or sensitive data or information systems. These persons

• • use standard user permissions;
• • have no access to system administration functions;
• • have no extensive access to sensitive data.

The Level 1 basic background check shall include:

• • identity verification;
• • submission and verification of documents attesting to education and qualifications;
• •assessment of work experience based on the documents submitted and, where necessary, publicly available sources.

Contacting previous employers shall not be mandatory for Level 1 checks unless there is an indication of risk or an inconsistency in the information provided.

3.2 Level 2 – Extended background check

Level 2 shall apply to positions and roles involving increased technical responsibility, responsibility for assets or managerial responsibility, and having a significant impact on the university’s information systems, data or financial resources.

Level 2 may apply, among others, to the following areas and roles:

• • information technology and system administration;
• • information system development and administration;
• • database management and data processing;
• • finance and accounting;
• • procurement, contract and asset management;
• • heads of structural units or area directors with decision-making authority over resources, access rights or assets;
• • other roles involving substantial financial responsibility or responsibility for other assets.

The Level 2 extended background check shall include the Level 1 checks and, in addition:

• • assessment of an extract from the Criminal Records Database submitted by the candidate;
• • obtaining a reference from at least one referee or previous employer.

The purpose of checking criminal records is to assess a person’s trustworthiness in roles that provide access to information systems, financial resources or sensitive data, or the ability to create a significant risk to assets or information security. Criminal record information shall be requested and assessed only where necessary and proportionate in view of the duties, access rights, responsibility for assets or security risks associated with the specific position. Only current criminal record information directly relevant to the duties of the position or its associated risks shall be taken into account. The existence of a criminal record shall not automatically disqualify a candidate. Decisions shall be made on a case-by-case basis, taking into account the nature, seriousness and date of the offence, its relevance to the position and its potential impact on the university’s legitimate interests.

The extended background check shall be conducted with the candidate’s written consent.

3.3 Level 3 – Background check for high-trust positions

Level 3 shall apply to roles involving strategic decision-making authority, a substantial impact on the university’s risk profile or direct responsibility for managing information security, cybersecurity or physical security.

Level 3 shall apply, among others, to:

• • members of the university’s Rector’s Office;
• • the information security manager and persons responsible for cybersecurity, physical security or risk management;
• • other positions identified as high-risk under the criteria for determining risk levels.

The recruitment specialist and the hiring manager shall decide whether to apply Level 3 on the basis of a risk assessment approved by the hiring manager. The risk assessment shall form part of the recruitment request.

The Level 3 background check for high-trust positions shall include the Level 2 checks and, in addition:

• • an extended reference check, including an assessment from at least one previous immediate superior;
• • a declaration of interests and outside activities.

The declaration of interests and outside activities shall include at least disclosure of the following:

• • ownership interests in companies or involvement in foundations or non-profit associations;
• • membership of a management board, supervisory board or other governing body outside the university;
• • existing contractual or advisory relationships with third parties;
• • potential links to suppliers, partners or competitors listed by the hiring manager;
• • other outside activities that may affect impartiality, independence or judgement.

4. Determining the background check level

When submitting a recruitment request, the hiring manager shall determine the background check level, consulting the recruitment specialist or relevant staff where necessary.

The background check level applicable to a position shall be determined on the basis of a risk assessment, taking into account the position’s impact on the university’s operations, assets, data, reputation and legal liability.

The following factors, among others, shall be considered when determining the risk level:

• • the extent of access to information systems and production environments, and the scope of administrative rights;
• • access to sensitive data, large volumes of data or special categories of personal data;
• • the ability to influence security settings, configurations, processes or policies;
• • the impact on the functioning of the university’s information security management system, compliance arrangements or risk management;
• • access to financial, strategic or commercially sensitive data;
• • substantial financial responsibility or responsibility for assets;
• • responsibility for cybersecurity, physical security or risk management;
• • strategic decision-making authority or impact on the organisation’s overall risk profile.

The risk assessment shall take into account both the position’s technical impact and its wider impact on the organisation, including its potential effects on the university’s reputation, contractual obligations and compliance with regulatory requirements.

For Level 2 and Level 3 background checks, the decision on the risk level and the supporting assessment shall be documented and retained with the background check records.

5. Conducting and documenting background checks, recurrent checks and responsibilities

Background checks shall be conducted as part of the recruitment process before an employment contract, an amendment to an employment contract recording transfer to another position, or any other contract is concluded.

The recruitment specialist or, where no recruitment specialist is involved in the recruitment process, the hiring manager shall be responsible for conducting the background check and shall:

• • arrange the check in accordance with the levels specified in this procedure;
• • ensure that the scope of the check corresponds to the assigned level;
• • document the results of Level 2 and Level 3 checks;
• • ensure that personal data are processed in compliance with applicable data protection requirements.

Background checks shall be conducted and their results recorded as follows:

• • For Level 1, the background check shall be conducted by the HR specialist or the hiring manager when the contract is concluded. The outcome shall be recorded through the conclusion of an employment contract or a contract under the law of obligations.
• • For Levels 2 and 3, the background check shall be conducted by the recruitment specialist and the hiring manager. The outcome shall be recorded through the conclusion of an employment contract or a contract under the law of obligations.

If a candidate refuses to provide the documents required for a background check, the university may decide not to enter into an employment relationship.

Materials collected during background checks shall be retained as follows:

• • If no employment contract or other contract is concluded, the materials shall be retained as part of the recruitment records for the applicable retention period or until the candidate’s consent expires. A contract may not be concluded if the parties cannot agree on its terms or if the outcome of the candidate’s background check is unsatisfactory.
• • If the candidate takes up employment, the materials from Level 2 and Level 3 background checks shall be retained in the document register as part of the individual’s personnel file, in accordance with the applicable retention rules.

Background checks shall be documented in a manner that enables subsequent verification. Access to background check materials shall be restricted and granted only where necessary for the performance of work duties.

After the initial background check, no routine recurrent checks shall be conducted during employment. A further background check shall be conducted for persons employed under an employment contract only in the following cases:

• • when transferring to a role or position requiring a Level 3 check;
• • when a significant change in risk increases the impact of the person’s access rights or responsibilities;
• • in the event of a security incident or where there are other valid grounds for a check relating to the individual’s duties or access rights;

A new background check shall not be required solely because the duties of a role or position within the university change unless those changes raise the risk level to Level 3.

Annex 2
PROCESSING OF PERSONAL DATA DURING THE JOB APPLICATION AND RECRUITMENT PROCESS

Tallinn University of Technology processes applicants’ personal data for recruitment purposes in accordance with the law to determine their suitability for employment.

The following personal data are used in recruitment:

• • name;
• • personal identification code;
• • date of birth and age;
• • contact details (including address, email address and telephone number);
• • information on education and work experience;
• • information on research and development activities for academic positions;
• • information on citizenship and, where necessary, the legal basis for residing and working in Estonia, and tax residency.

Applicants shall provide their personal data when applying for a position and shall be responsible for the accuracy of the data provided.

During the recruitment process, the university may check publicly available information about an applicant only to the extent necessary to assess their suitability for the position, qualifications, work experience or risks associated with the position. Information obtained from public sources shall not be used to evaluate an applicant’s private life, beliefs, health, family circumstances or any other matters unrelated to the duties of the position. If essential information collected from public sources is used in making a decision concerning a candidate, the applicant shall be informed and given an opportunity to provide explanations.

Level 2 and Level 3 background checks shall be conducted only with the applicant’s consent.

During background checks, personal data shall be processed only to the extent necessary to assess the applicant’s suitability and trustworthiness, as well as the risks associated with the specific position or role. The legal basis for each background check activity shall be determined separately in accordance with the General Data Protection Regulation, the Employment Contracts Act and other applicable legislation. The applicant’s consent shall be used as the basis for a check only where it is appropriate and given voluntarily, and where refusal to consent does not result in unjustified adverse consequences for the applicant.

During the recruitment process, the university may conduct tests necessary for selecting candidates with the applicant’s prior consent.

Applicants’ data shall be retained for one year after the results of the recruitment competition have been finalised. Applicants’ data shall be securely destroyed upon expiry of the retention period.

Tallinn University of Technology shall implement appropriate organisational, physical and technical information security measures when processing applicants’ personal data to ensure the availability, integrity and confidentiality of the information processed.

Personal data concerning an applicant’s private life, the disclosure of which could infringe their privacy, shall be treated as information for internal use only and subject to access restrictions.

Applicants shall have the right to request access to their personal data and to request its rectification or deletion. Applicants shall have the right to submit a complaint to the supervisory authority regarding unlawful processing of their personal data.

Annex 3
PRINCIPLES OF EQUAL TREATMENT IN THE RECRUITMENT PROCESS

1. Purpose

The aim of the recruitment process is to ensure equal, fair and transparent treatment of all candidates and to select the candidate whose knowledge, skills, experience and competencies best meet the requirements for the position.

2. Principle of equal treatment

All candidates shall be treated equally throughout the recruitment process.

Candidates shall be assessed solely on the basis of the requirements for the position, their qualifications, work experience, competencies, and the knowledge and skills necessary to perform the duties of the position.

Decisions shall not be based on factors unrelated to the performance of those duties.

3. Prohibition of discrimination

Recruitment decisions shall not be based on a candidate’s sex, age, nationality, ethnic origin, race, colour, language, religion or beliefs, disability, sexual orientation, pregnancy, parental status, family responsibilities or any other characteristic protected by law.

Candidates shall not be asked for information or explanations relating to these characteristics. Any such information shall be provided only voluntarily by the candidate.

4. Justification of requirements for a position

The requirements for a position shall be necessary for the work to be performed, objectively justified and proportionate. No requirements shall be imposed that could unjustifiably restrict the pool of candidates.

5. Work of the recruitment committee

The recruitment committee shall apply the same assessment criteria to all candidates, ask them similar questions and avoid conflicts of interest. A committee member shall withdraw from the selection process if there are reasonable grounds to question his/her impartiality.