Citizen science & data

Indigenous Data Sovereignty: The CARE Principles, OCAP and What They Mean for Researchers

Citizen science & data · · Published 2026-10-26

A narrow aisle between tall metal shelves filled with archive boxes and folders
Archive storage. Who holds data, and who decides how they are used, are central questions of data sovereignty. Photo: Samuel Zeller, CC0, via Wikimedia Commons.

Indigenous data sovereignty is the principle that Indigenous peoples have the right to govern the collection, ownership and use of data about their communities, lands and resources. It has reshaped how many universities, funders and data repositories think about research data, and it offers lessons for any project that collects data with a community.

Why data sovereignty matters

For generations, Indigenous communities have been among the most studied people in the world, yet they have rarely controlled the data collected about them. Data have been used to support policies that harmed communities, stored in institutions far away, reused without permission, and presented in ways that emphasise deficits. The digital era has made the stakes higher: genetic data, health records and environmental data can be copied, combined and shared at scale.

The right to self-determination underpins the movement. The United Nations Declaration on the Rights of Indigenous Peoples, adopted by the UN General Assembly on 13 September 2007, recognises Indigenous peoples' rights to self-determination and, in Article 31, their right to maintain, control, protect and develop their cultural heritage, traditional knowledge and related intellectual property.

FAIR and CARE

The FAIR Guiding Principles, published by Mark Wilkinson and colleagues in Scientific Data in 2016, say that research data should be Findable, Accessible, Interoperable and Reusable. They have been adopted by many funders and repositories. FAIR is about making data easy for machines and researchers to use; it says little about who should benefit or who decides.

The CARE Principles for Indigenous Data Governance, released in 2019 by the Global Indigenous Data Alliance and described in a 2020 article in the Data Science Journal led by Stephanie Russo Carroll, add a people- and purpose-oriented layer:

The alliance's slogan, "Be FAIR and CARE", signals that the two sets of principles are meant to work together.

OCAP in Canada

In Canada, the First Nations principles of OCAP, which stand for ownership, control, access and possession, were developed from 1998 in connection with the First Nations Regional Longitudinal Health Survey and are stewarded by the First Nations Information Governance Centre, which holds OCAP as a registered trademark. In brief, OCAP asserts that First Nations collectively own their information, control how it is collected and used, have access to data about themselves, and should physically hold their data. Canada's federal research ethics policy, the Tri-Council Policy Statement (TCPS 2), devotes a full chapter (Chapter 9) to research involving First Nations, Inuit and Métis peoples, including community engagement and data agreements.

Other national movements

In Aotearoa New Zealand, Te Mana Raraunga, the Māori Data Sovereignty Network, was founded in 2015 and has published principles of Māori data sovereignty. In Australia, the Maiam nayri Wingara Aboriginal and Torres Strait Islander Data Sovereignty Collective issued principles in 2018, and the Australian Institute of Aboriginal and Torres Strait Islander Studies (AIATSIS) publishes a Code of Ethics for Aboriginal and Torres Strait Islander Research (2020). In the United States, the US Indigenous Data Sovereignty Network works with tribal nations and researchers.

A cautionary case: the Havasupai samples

In the early 1990s, researchers from Arizona State University collected blood samples from members of the Havasupai Tribe, who live in and around the Grand Canyon, for a study of diabetes. Tribal members later learned that the samples had also been used for studies on other topics, including schizophrenia, inbreeding and the population's ancient migrations, which they had not agreed to and which conflicted with their beliefs. The tribe sued; in 2010 the Arizona Board of Regents reached a settlement that included a payment of 700,000 dollars to tribal members and the return of the remaining samples. The case is widely taught as an example of why broad or vague consent is not enough, and why communities, not only individuals, may need a say in secondary uses of data.

What research teams can do

  1. Start with the community's governance. Many Indigenous nations have their own research review processes, data policies or research offices. Contact them before designing the project.
  2. Write a data agreement. Cover ownership, storage location, access, secondary use, publication approval, return or destruction of data and samples, and what happens when the project ends.
  3. Plan for collective as well as individual consent. Our article on research ethics with communities discusses how the two fit together.
  4. Use labels and metadata. Initiatives such as the Local Contexts project's Traditional Knowledge and Biocultural Labels let communities attach conditions and provenance information to data and collections held in repositories.
  5. Return benefits. Share results in usable forms, build local data capacity, and budget for community data infrastructure.
  6. Be careful with "open by default". Openness is valuable, but not all data should be open. See our guide to open and community data.

Lessons for non-Indigenous community research

The CARE principles were written for Indigenous peoples, whose rights rest on specific legal and historical foundations, and they should not be casually appropriated. But their questions (who benefits, who controls, who is accountable) are useful for any community data project, including resident-led citizen science. A neighbourhood group monitoring housing conditions, for example, also has to decide whether street-level data could harm the residents who provided them.

Sources