Working through this guidance with honesty is the first step. The second is going further by reaching out to the Nations you work with, reading their protocols‡, and asking how your systems need to change to align with their governance.
How to Develop Your Data Governance - For Organizations Respecting Indigenous Data Rights
*Any terms defined in the glossary are marked with ‡. View the glossary here.
Disclaimer
This guidance is for organizations — health services, government agencies, researchers, tech companies, NGOs — that work with Indigenous communities and hold, use, or want to use Indigenous data. It does not replace Nation-led governance‡. It helps your organization understand its responsibilities and build systems that genuinely respect Indigenous authority.
Acknowledgement
This section draws from training materials developed by Wabusk Data Solutions and is shared in the spirit of learning and capacity building. All rights and ownership remain with Wabusk Data Solutions and use beyond this context should respect both intellectual property and Indigenous relational accountability.
Starting Questions For Your Organization
Does your organization hold data about Indigenous Peoples, communities, lands, or cultural knowledge? Does it use AI‡ tools that might interact with that data, even as a background feature?
If the answer to either question is yes, this guidance is for you.
Respecting Indigenous data sovereignty‡ means shifting your organization's posture from treating Indigenous data as a resource to be used to recognizing it as something that belongs to and must be governed by the people it comes from.
Step 1 — Know Whose Data You Hold: Map Your Indigenous Data Landscape
Before you can respect Indigenous data sovereignty, you need to understand what Indigenous data your organization actually holds and uses.
List the types of Indigenous data your organization holds and where each type lives in your systems.
Indigenous data is not only statistics or research datasets‡. It includes health records connected to community members, land and environmental data, cultural artifacts or knowledge held in archives, language materials, administrative records about individuals and families, and any AI training data‡ that includes Indigenous people or communities.
Which Indigenous Nations or communities does this data relate to?
Do you know where this data originated and whether it was collected with appropriate consent?
Are any AI tools currently interacting with this data — even in ways that weren't explicitly planned?
Step 2 — Recognize Authority: Learn Who Actually Governs This Data
Your organization does not govern Indigenous data; the Nations and communities it comes from do. This step is about finding out who holds that authority, what their governance structures look like, and how your organization can align with them rather than work around them.
The three things you need to know:
Governance bodies
Who has formal authority over data decisions (a council, committee, Elders group, or data governance‡ office)?
Protocols and frameworks
Has the Nation adopted OCAP®, a community data policy‡, or its own data governance framework? Ask for it and read it.
Decision pathways
What is the process for approving data use? Who needs to sign off, and what timelines should your organization respect?
Reflection questions
Name the Nations whose data you hold, note their governance contacts, and record any existing frameworks or protocols your organization has already reviewed
Does your organization have a designated person responsible for maintaining relationships with the Indigenous Nations whose data you steward?
Step 3 — Formalize Agreements: Put Respect in Writing
Formal agreements are how your organization makes its respect for Indigenous data sovereignty enforceable. These agreements define responsibilities, set limits, and establish what happens when things go wrong.
Examples of these agreements are:
- Data sharing agreement: The legal conditions under which your organization can collect, use, or store Indigenous data. Must include:
- purpose limitation (the data can only be used for what was agreed),
- security requirements,
- retention and deletion timelines, and
- explicit restrictions on secondary use — including feeding data into AI systems.
- Research agreement: If your organization conducts research involving Indigenous communities, this agreement sets the terms:
- how Free, Prior and Informed Consent‡ was obtained,
- who owns the findings,
- how results are shared back with the community,
- what approvals are required at each stage, and
- how benefit flows back to the Nation.
- AI and Technology Vendor Contracts: Before using any AI tool with Indigenous data, your contracts with vendors must reflect Nation governance expectations, not just corporate terms of service. Include sovereignty clauses affirming that data remains subject to Indigenous jurisdiction‡ regardless of where it is stored or processed.
Reflection questions
Are there formal agreements with the Nations your organization has active relationships with?
What happens in practice if your organization breaches an agreement?
List the agreements your organization needs to put in place or update and note who needs to be involved from the Nation side.
Step 4 — Embed Respect in Your Internal Systems
External agreements only work if your internal systems reflect them. This step is about making Indigenous data sovereignty part of how your organization actually operates.
Examples of what will likely need to be adjusted:
- Policies: Update your data governance, privacy, AI, and IT policies to explicitly address Indigenous data, including restrictions on AI tools interacting with it without Nation approval.
- Staff roles: Designate who is responsible for maintaining Nation relationships, managing data agreements, and flagging potential breaches.
- Procurement‡: Add Indigenous data sovereignty requirements to your vendor assessment process. Before adopting any AI tool, assess whether it could interact with Indigenous data and what safeguards are in place.
- Workflows: Build consent and approval checkpoints into processes that involve Indigenous data so decisions about sharing or using it always go through the right pathway.
Reflection questions
Do your internal policies and procedures explicitly address Indigenous data sovereignty?
Does your procurement process screen for AI interactions with Indigenous data?
Is there a person accountable for relationships and data agreements with Indigenous Nations?
Step 5 — Build Accountability: Report Back and Stay Accountable
Accountability is relational. It means your organization reports back to the Nations whose data you hold, and creates genuine pathways for them to raise concerns, request audits, or require remedies when things go wrong. Mechanisms to consider include:
- Reporting back
- Regular reporting to Nations on how their data has been used
- Transparency‡ about any AI tools that have interacted with the data
- Plain-language summaries of data activities that don’t have any technical jargon
- Proactive disclosure when something has gone wrong
- Remedy pathways
- A clear process for Nations to raise concerns or report misuse
- Audit rights that allow Nations to verify compliance
- Consequences for breaches that are meaningful and enforceable
- Processes that do not require Nations to chase your organization for answers
Reflection questions
Does your organization proactively report to Nations on how their data is used, how?
Do Nations have a meaningful right to audit your data practices?
Are your breach response procedures designed to protect Nation interests?
Draft your organization's reporting and accountability commitments to the Nations whose data you hold.
Putting It All Together — Your Organization's Indigenous Data Sovereignty Roadmap
Use this roadmap as a planning tool. The goal is not to complete it once but rather to make genuine, ongoing respect for Indigenous data sovereignty part of how your organization does business.
- Recognize Indigenous rights and jurisdiction: Acknowledge that Nations hold inherent authority over their data.
- Learn Nation governance structures: Read their protocols, meet their data governance contacts, and understand how decisions are made. This can include taking the Fundamentals of OCAP® course offered through the First Nations Information Governance Center.
- Put formal agreements in place: Data sharing, research, and AI vendor contracts that reflect Nation law with sovereignty clauses, purpose limits, and enforcement.
- Embed respect in internal systems: Policies, procurement, workflows, and staff roles that operationalize Indigenous data sovereignty day to day.
- Report back and build ongoing accountability: Regular reporting to Nations, audit rights, clear remedy pathways, and a named accountability contact.
Footnotes
[1] OCAP® is a registered trademark of the First Nations Information Governance Centre (FNIGC). See First Nations Information Governance Centre, The First Nations Principles of OCAP®, 2025, https://fnigc.ca/ocap-training/