Indigenous data sovereignty

Indigenous data sovereignty (IDS) is the movement framing through which indigenous peoples globally assert their inherent right to govern data generated from and about their communities, territories, languages, and knowledge systems — and, increasingly, AI systems trained on that data. The framing's working premise is that data sovereignty flows from political sovereignty: nations and peoples who hold inherent rights to self-determination also hold rights over information about themselves, and no data-collection, analysis, or training process performed on indigenous peoples' data is legitimate without their ongoing governance of that process. Distinct from the adjacent data colonialism framing that Latin American civil society carries — which diagnoses AI extraction as a structural harm — and from the algorithmic colonialism framing through which African civil society names the imposition of alien AI systems on African populations — IDS is as much a governance-design demand as a critique. It does not primarily ask that data systems harm indigenous peoples less; it asks who holds authority over those systems in the first place, and answers that indigenous peoples themselves must own, control, access, and possess the data that flows from within their communities.

Origins: from OCAP® to an international agenda

The framing's institutional precursor is OCAP® — Ownership, Control, Access, Possession — the governance framework developed in 1998 by the National Steering Committee of the First Nations and Inuit Regional Longitudinal Health Survey, a body of Canadian First Nations leadership that framed data governance as inseparable from nation-to-nation relationships. The four principles asserted that First Nations alone control data collection in their communities, own how information is stored and shared, determine who may access their data, and physically possess it. The First Nations Information Governance Centre (FNIGC), formed in April 2010 as a stand-alone non-profit from that Steering Committee lineage, trademarked OCAP® and built a national certification and training apparatus around the framework. OCAP® is explicitly a framework for First Nations in Canada; the movement's convergence into a shared international agenda came a decade and a half later.

The international academic codification of IDS as a field came with the 2016 ANU Press volume Indigenous Data Sovereignty: Toward an Agenda, edited by Tahu Kukutai (then a Professor of Demography at the University of Waikato, later a founding member of Te Mana Raraunga) and John Taylor of the Australian National University. The book drew on a 2015 Canberra workshop with contributors primarily from CANZUS states — Canada, Australia, New Zealand, United States — and grounded IDS as a rights claim under the United Nations Declaration on the Rights of Indigenous Peoples (UNDRIP), arguing that indigenous peoples hold inherent and inalienable rights relating to the collection, ownership, and application of data about their members, territories, and lifeways, and that no open-data or open-science convention overrides those prior rights. The 2016 volume established the CANZUS network as the framing's early institutional home and set the UNDRIP foundation on which GIDA and the CARE Principles would subsequently build.

The CARE Principles

The globally-propagated codification of the framing is the CARE Principles for Indigenous Data Governance, developed at an International Data Week workshop held on 8 November 2018 in Gaborone, Botswana, co-led by Stephanie Russo Carroll (University of Arizona) and Maui Hudson (University of Waikato, Aotearoa New Zealand), with thirteen additional contributors drawn from the nascent international IDS network. Formally released by GIDA on 6 September 2019 and peer-reviewed published in the Data Science Journal in November 2020, the principles — Collective Benefit, Authority to Control, Responsibility, Ethics — address a structural gap in the open-data movement: where FAIR (Findable, Accessible, Interoperable, Reusable) governs data as an object to be shared and reused, CARE governs data as something generated from and by communities who retain relational and governance rights over it regardless of where the data travels. The GIDA "#BeFAIRandCARE" initiative positioned the two frameworks as complementary rather than competing, with CARE adding people-and-purpose orientation to FAIR's object-and-property orientation. Collective Benefit requires data ecosystems to enable indigenous nations and communities to derive benefit from the data; Authority to Control establishes that indigenous peoples hold rights to govern their data, including data held by external entities about them; Responsibility requires those working with indigenous data to share how data are used and foster respectful relationships; and Ethics requires indigenous peoples' rights and wellbeing to be the primary concern at all stages of the data life cycle.

GIDA, the international body that released the CARE Principles, was itself founded at a workshop in Oñati, Spain on 11–12 July 2019, convened by Maggie Walter and Desi Rodriguez-Lonebear, with founding members from the Maiam nayri Wingara Collective (Australia), Te Mana Raraunga (Aotearoa New Zealand), and the United States Indigenous Data Sovereignty Network (USIDSN). GIDA takes its name from the Basque word for "guide." Each founding member represented a national IDS network that had developed the framing independently before converging under a global coordinating structure.

National networks

Four national networks form the institutional spine of the movement. In Canada, the First Nations Information Governance Centre (FNIGC) holds OCAP® as a standing framework, producing training, certification, and a growing body of guidance applying First Nations data-governance principles to health surveys, census records, and — increasingly — AI systems. In Aotearoa New Zealand, Te Mana Raraunga (the Māori Data Sovereignty Network) is the Pacific anchor of the movement; the idea emerged at a July 2015 workshop in Australia, the inaugural hui was held at Hopuhopu on 19 October 2015, and the charter was ratified at Papakura Marae on 5 April 2016, framing Māori data as a taonga — a treasured resource requiring culturally grounded governance — and developing the Te Kāhui Raraunga Māori Data Governance Model for use across the Aotearoa New Zealand public service. In Australia, Maiam nayri Wingara (the Aboriginal and Torres Strait Islander Data Sovereignty Collective), named in Gooniyandi for "to hold" and in Barrngala for "to shine," is a GIDA founding member and frames IDS as both a governance tool and a mechanism for self-determination aligned with UNDRIP. In the United States, the USIDSN, based at the Native Nations Institute at the University of Arizona, supports tribal nations in developing data-governance frameworks at the tribal level, addressing census data, health data, and increasingly AI training data.

AI-specific applications: the Kaitiakitanga License and the indigenous-AI movement

The framing's most prominent applied form in AI governance is the Kaitiakitanga License developed by Te Hiku Media, the Māori iwi broadcaster based in Kaitaia, Aotearoa New Zealand, that built the first te reo Māori speech-recognition AI under indigenous stewardship terms. The Kaitiakitanga License grounds the data corpus Te Hiku Media curated as a stewardship relationship rather than transferable intellectual property: data is not owned but cared for under kaitiakitanga, and any benefit derived from it flows back to the source community. The licence grants access only to organisations that respect Māori values, remain within the bounds of consent given by speakers, and return benefits to the Māori people, and explicitly prohibits use of the tools for discrimination, surveillance, or tracking. Chief Technology Officer Keoni Mahelona has stated the political stake as "Data is the last frontier of colonization"; Peter-Lucas Jones, Chief Executive, has warned that absent indigenous governance structures, Māori-language data would be used by "the very people that beat that language out of our mouths to sell it back to us as a service". The Kaitiakitanga License operationalises the IDS framing not as a policy statement for state institutions to adopt but as a community-controlled licensing instrument that an indigenous organisation deploys directly over its own AI assets, making it the working example most cited in the indigenous-AI literature.

Beyond Te Hiku Media, the framing has entered AI governance through the Indigenous Protocols for Artificial Intelligence (IP-AI) workshops — held first in Honolulu, Hawai'i in 2019 — which established a community of practice around the question of what it means for indigenous communities to be the makers of AI rather than only its consumers, bringing together indigenous AI practitioners including Peter-Lucas Jones. The Collaboratory for Indigenous Data Governance at the University of Arizona led the development of the IEEE 2890-2025 standard for provenance documentation of Indigenous Peoples' data — establishing a technical specification that any AI pipeline incorporating indigenous data must document that data's provenance and governance lineage. The WAMPUM Lab (University of Waterloo) and the Collaboratory jointly submitted a CARE Statement for Indigenous Data Sovereignty as a formal input to the UN Global Digital Compact negotiations, arguing that any multilateral AI governance framework must incorporate indigenous peoples' authority to control data about themselves as a matter of UNDRIP compliance.

Why it differs from adjacent framings

Three distinctions separate indigenous data sovereignty from the corpus's adjacent decolonial-AI framings. Where data colonialism names the structural asymmetry of accumulation between jurisdictions — a critique whose political demand is regulatory and redistributive — and algorithmic colonialism names the corporate mechanism through which that asymmetry plays out on African populations — a critique whose demand is resistance and redress — IDS names a specific governance authority: the right of sovereign peoples to govern the data apparatus from within, on their own terms. The framing does not ask that data systems harm indigenous peoples less; it asks that indigenous peoples control the systems that handle their data. The Kaitiakitanga License and the CARE Principles are governance instruments, not protest documents.

The IDS framing also differs from feminist AI — which emphasises inclusive design and intersectional accountability within the existing AI-development ecosystem — in that IDS rests on a foundation of sovereignty rather than inclusion. Indigenous peoples hold not merely inclusion rights within a shared data commons but property rights, governance authority, and relational accountability over data that flows from within their communities — claims grounded in UNDRIP, in treaty rights, and in prior, continuing relationships between peoples and their knowledge systems that no open-data convention overrides.

The third distinction is geographic and political: where data colonialism and algorithmic colonialism primarily name harms inflicted by Global North actors on Global South populations, IDS operates across multiple jurisdictions simultaneously — within Canada, Australia, Aotearoa New Zealand, and the United States as much as across the Global South — because the structural position of indigenous peoples within settler-colonial states creates IDS claims inside the very jurisdictions that anchor the AI industry. The CARE Principles and OCAP® are operative inside, not only against, the jurisdictions that build the world's largest AI systems.