This guidance is for Nations‡ who are ready to assert authority over their data or who are building on existing governance work. It walks you through six foundational areas, with plain-language explanations, reflection questions, and template spaces to start capturing your Nation's own answers.
Download the PDF to use as a working document. Write in it. Come back to it. Governance is not a one-time project — it's an ongoing exercise of sovereignty.
*Any terms defined in the glossary are marked with ‡. View the glossary here.
Disclaimer
This section is intended as general guidance and does not constitute legal advice. The information provided is meant to support learning and reflection, not to replace legal counsel or Nation-specific decision-making.
Every Nation’s approach to data governance‡ is unique and should be grounded in its own laws, values, protocols‡, and priorities. The ideas and steps outlined here are not a fixed formula, but a starting point to support your own path. They should be adapted, expanded, or reimagined in ways that reflect your governance‡ systems, community context, and self-determined vision for data and technology.
Acknowledgement
This section draws from training materials developed by Wabusk Data Solutions and is shared in the spirit of learning and capacity building. All rights and ownership remain with Wabusk Data Solutions and use beyond this context should respect both intellectual property and Indigenous relational accountability.
Western definitions describe data as facts, figures, and records. But if you set that aside and ask what truly holds meaning for your Nation, what would you say?
Data might include family histories, sacred site locations, oral traditions, land-use patterns, health records, language recordings, ceremony protocols, bead patterns, regalia, or the email list for your youth program. If it carries meaning about your people, land, programs, or decisions, it is data, and your Nation has a right to govern it.
Before building any system or writing a policy‡, ask: what relationships does this data carry? Every piece of information is connected to people, places, living things, and obligations. Governance that starts here becomes values-driven rather than a compliance exercise.
Think about a specific dataset‡ or type of information your Nation holds. This helps you understand the relational accountability‡ you have when deciding to have AI‡ interact with certain types of data.
Understanding these connections helps you decide not just how to protect data, but why it matters and who is responsible for it.
Who or what is this data connected to — people, places, living things, programs, cultural items?
Who benefits from its use, and who could be harmed if it is misused?
How is data collected, stored, and categorized — and why?
Who is accountable for stewarding it?
Authority means decision-making power. Without clarity on who decides, governance breaks down. Especially when an institution or technical system tries to bypass community structures. Establishing authority grounded in your Nation's laws and governance means no one can act on your data without a clear pathway to approval.
Your Nation may have existing governance bodies such as a council, an elders' group, a committee, or a designated department. Authority for data governance can sit within these structures or alongside them, but it must be formally recognized. This also means documenting which of your laws, protocols, and teachings apply to data and which external laws (such as the Privacy Act or PIPEDA) impose additional obligations. Remember that any AI system that interacts with your data must go through your authority structure for approval — not just an IT sign-off.
Who has the right to decide how data is used — for different types of data?
Which Indigenous laws, teachings, or protocols apply?
What external laws or regulatory frameworks create obligations?
What approvals are required before data is shared externally?
Draft your Nation's data authority statement — who decides, and how decisions are made.
Consent in Indigenous governance is not a form signed once and filed. It is a living relationship; an ongoing conversation between communities and those responsible for caring for their data. Sovereignty over data means your Nation defines what consent looks like, how it is obtained, and how it can be withdrawn.
Some data has implications for the whole Nation. Language recordings, health patterns, kinship data, and land-use information all carry collective meaning. Your governance framework‡ needs to define when community or Nation-level consent is required alongside individual consent.
What does consent look like in your cultural context — and how is it obtained and documented? It might be a formal resolution, Elder consultation, community meeting, or a documented protocol. It might look different for different types of data.
How does your Nation document consent?
How is the ability to withdraw or modify consent respected?
Who controls access to data, including in external systems and AI platforms?
Does your Nation distinguish between individual and collective consent — and when does each apply?
Some knowledge should not be digitized. Some data should never enter an AI system. Governance means making those decisions proactively. Trauma-informed, culturally grounded data practices protect people, relationships, and knowledge that cannot be unshared once it is out.
Some examples of these distinguishers could be:
Publicly available or broadly accessible to community members. Low risk. Can be shared with researchers or partners under standard agreements.
Examples: program schedules, public reports, news.
Requires explicit approval before sharing outside the Nation. Handled under formal agreements with purpose limits and security requirements.
Examples: health records, family data, land use surveys.
Governed entirely by cultural law and Elders/knowledge keepers. Never enters external systems without cultural governance sign-off. Some knowledge should not be digitized at all.
Examples: ceremony knowledge, sacred site details, kinship systems.
One of the most practical tools available for asserting Indigenous data sovereignty‡ over cultural materials is the Traditional Knowledge‡ (TK) Labels [1] system, developed through the Local Contexts initiative [2]. TK Labels are a set of customizable tags that Indigenous communities can attach to digital cultural materials, such as recordings, images, language, stories, and knowledge, to communicate how those materials should be accessed, cited, shared, and used, regardless of where they are currently held.
The Labels address a gap that copyright law cannot fill by re-centering authorship. It’s not the person who took the photo, recorded the audio, or wrote down the language, it's the communities those materials came from.
The Passamaquoddy Nation have translated the TK Labels and customized them in their own words for 130-year-old wax cylinder recordings [3] held at the Library of Congress. They state clearly: "We consider ourselves to be the authority and custodians over these recordings regardless of who is considered the 'legal owners."
For communities thinking specifically about AI, TK Labels are an important layer of protection. Attaching TK Labels to digital cultural materials signals to institutions, researchers, and AI developers alike that the community retains governance authority over that knowledge and that its use without consent is unacceptable, regardless of where it sits online.
Classification‡ systems become most effective when they are embedded directly into how data is labelled and described. Labels and metadata are practical tools that carry governance decisions with the data itself, indicating sensitivity, cultural significance, access permissions, and usage restrictions. Rather than relying solely on policy documents, these markers ensure that anyone interacting with the data understands their responsibilities.
What types of data exist in your Nation, and what classification would you apply to each?
Could the digitization or sharing of certain knowledge cause harm, and how could those risks be mitigated?
Should any knowledge remain offline, undigitized, or governed only by Elders and cultural protocols?
Are your current safeguards proportionate to the sensitivity of what they protect?
Does your Nation distinguish between individual and collective consent — and when does each apply?
Accountability structures make governance real because they ensure that roles are clear, decisions are tracked, and community members don't have to chase down information about how their data is being used. Stewardship is an ongoing responsibility, not a one-time setup.
Map your stewardship roles
Who holds each responsibility in your Nation?
Data Steward‡
Overall accountability for data governance
Data Custodian‡
Day-to-day management and security of specific datasets
Cultural Guardian
Authority over sacred and restricted knowledge
Governance Oversight Body
A committee or council that reviews and enforces
Community Contact
Clear point of contact for questions, concerns, or complaints
What accountability structures currently oversee how data is used in your Nation?
Which policies govern access, security, and sharing?
Are stewardship responsibilities formally defined and monitored, or informal and unclear?
How are breaches or concerns raised and addressed?
At present, there are no formal, system-wide oversight bodies dedicated specifically to Indigenous data sovereignty. While organizations such as the Office of the Information and Privacy Commissioner (IPC) may advocate for privacy and occasionally support conversations related to Indigenous data, they do not have a mandate to enforce Indigenous data governance or uphold Nation-specific authority. In many cases, these bodies operate within legislative frameworks that lawmakers did not design to recognize or enforce Indigenous jurisdiction‡.
There are also important Indigenous-led organizations, such as the First Nations Information Governance Centre, as well as regional governance bodies, such as the British Columbia First Nations Regional Information Governance Centre [4], that play critical roles in advancing data sovereignty, supporting communities, and developing frameworks like OCAP® [5]. However, these organizations are not regulatory authorities and generally do not provide enforcement or accountability mechanisms. Their role is to support, advocate, and guide, not to intervene or adjudicate disputes.
In the absence of broader, enforceable accountability systems, the responsibility falls to each Nation to define and implement its own processes. While this can place additional pressure on communities, it also underscores the importance of Nation-led governance systems grounded in local laws, values, and authority.
Every digital system your Nation uses is a governance decision. Where your data lives, who administers the platform, what jurisdiction applies, and whether AI touches your data — all of these have real implications for sovereignty. This step is about making those decisions consciously rather than by default.
About the system
About AI specifically
List the digital systems your Nation currently uses and note any AI interactions or governance gaps you've identified
Once you've worked through each step, the next move is turning your answers into a formal governance framework. Here's an outline to use as a starting point. Adapt it to fit your own governance structures and pace.
A Nation can have the best data governance policy on paper and still have it ignored by an AI company or institution. Accountability mechanisms are what make sovereignty real. The enforcement gap remains one of the biggest challenges: external actors often comply only partially because jurisdictional ambiguity gives them an out. Closing that gap is active, ongoing governance work.
[1] Local Contexts and Sustainable Heritage Network, Traditional Knowledge Labels: Supporting Indigenous Data Sovereignty through Labeling (presentation slides, Sustainable Heritage Network, 2020), https://sustainableheritagenetwork.org/system/files/atoms/file/dsc4.18.pdf.
[2] Local Contexts, “Grounding Indigenous Rights,” accessed August 25, 2026, https://localcontexts.org/.
[3] Passamaquoddy People, “Passamaquoddy Traditional Knowledge Labels,” accessed August 25, 2026, https://www.passamaquoddypeople.com/passamaquoddy-traditional-knowledge-labels.
[4] British Columbia First Nations Regional Information Governance Centre, “Strengthening Data for Governance,” accessed August 25, 2026, https://bcfnrigc.ca/.
[5] OCAP® is a registered trademark of the First Nations Information Governance Centre (FNIGC). See First Nations Information Governance Centre, The First Nations Principles of OCAP®, 2025, https://fnigc.ca/ocap-training/
