Data about people is never neutral, and for Indigenous peoples the question of who holds authority over that data carries particular weight. Historically, research involving Indigenous communities was too often done to them rather than with them: data was collected by outside researchers, taken away, analysed and published with little regard for the communities’ own authority over knowledge about themselves, and sometimes to their detriment. The principles of Ownership, Control, Access and Possession — known as OCAP® — were developed by and for First Nations in Canada to reverse that pattern and assert collective self-determination over data. This article looks at how OCAP works in practice and how it relates to the wider movement for Indigenous data governance, drawing on the Indigenous data and CARE domain of the CASRAI Dictionary.
What the four principles assert
OCAP names four related forms of collective authority. Ownership refers to the relationship of a First Nations community to its cultural knowledge, data and information, asserting that the community owns this information collectively in the way an individual owns their personal information. Control asserts the right of First Nations to control how information about them is collected, used and managed throughout the entire research lifecycle — from the framing of a study to the use of its findings. Access means that First Nations must have access to information and data about themselves, wherever it is held, and the right to decide who else may access it. Possession refers to the physical control of data: the principle that data should, where possible, be held by the community itself, as the most concrete mechanism for asserting and protecting ownership. Together the four move authority from the outside researcher or institution to the community whose data is at stake. They are principles of collective rights, which distinguishes them from data-protection regimes built primarily around individual privacy.
OCAP as self-determination
It is important to understand OCAP not merely as a set of data-handling rules but as an expression of self-determination. The principles assert that First Nations — not governments, universities or external researchers — should decide how data about their communities is gathered and used. Stewardship of OCAP has been led by First Nations themselves, notably through the First Nations Information Governance Centre (FNIGC), which maintains the principles and supports their application. This community ownership is itself part of the point: OCAP is not a code handed down by outsiders but principles developed by First Nations to govern research on their own terms. Respecting OCAP means engaging with communities as governing partners, not as subjects.
How OCAP complements CARE and FAIR
OCAP sits within a broader international movement for Indigenous data sovereignty, and it complements two other frameworks readers may know. The FAIR principles — Findable, Accessible, Interoperable, Reusable — are concerned with the technical qualities that make data useful and shareable, but they are largely silent on people, power and purpose. The CARE Principles for Indigenous Data Governance — Collective benefit, Authority to control, Responsibility and Ethics — were articulated to fill that gap, insisting that data practice serve Indigenous peoples’ interests and respect their authority. CARE and FAIR are explicitly designed to work together: FAIR ensures data is well-managed and reusable, while CARE ensures that reuse is governed ethically and in the interests of the people the data concerns. OCAP can be seen as a concrete, community-developed articulation of these governance commitments for First Nations specifically — the operational expression, in the Canadian First Nations context, of the authority and benefit that CARE asserts in principle. The frameworks reinforce rather than compete with one another.
Indigenous data sovereignty as a global movement
This is not a Canadian phenomenon alone. Indigenous data sovereignty networks have formed around the world, asserting the rights of Indigenous peoples to govern data about their communities, lands and cultures. In Australia, Maiam nayri Wingara, the Indigenous Data Sovereignty Collective, has articulated principles and priorities for Aboriginal and Torres Strait Islander data. Similar movements exist in Aotearoa New Zealand, the United States and elsewhere. What unites them is a shared insistence that the people a dataset is about should have authority over it — a principle with obvious resonance well beyond Indigenous contexts, but with particular urgency given the history of how Indigenous data has been treated.
Making governance visible: TK and BC Labels
Principles need practical mechanisms if they are to shape what actually happens to data. Local Contexts provides one of the most important: Traditional Knowledge (TK) Labels and Biocultural (BC) Labels. These are digital labels that can be attached to data, collections and records to communicate the community-specific provenance, protocols and permissions associated with Indigenous knowledge — signalling, for example, that material is associated with particular protocols around its use, attribution or seasonal sharing. The labels make governance visible and machine-readable in the metadata that travels with data, so that a researcher or repository encountering the material knows that community authority and protocols apply, and what they are. They turn the abstract claim “this community has rights over this data” into a concrete signal embedded in the record itself.
A consistent vocabulary for governed data
For Indigenous data governance to be respected across repositories, institutions and systems, the way governance is described must mean the same thing everywhere — what a label signals, what permissions apply, what authority governs a record. That consistency is what the CASRAI Dictionary works towards: a shared vocabulary so that governance information attached to data is honoured wherever the data travels. And because research conducted with and for communities involves genuine contribution from community members and stewards, that work can be recognised within the same frameworks used for all contribution, such as the CRediT taxonomy and its full set of contribution roles. OCAP, CARE and the labelling systems built around them share a single conviction: that data about people belongs, in a deep sense, to those people — and that good research practice means honouring that authority rather than overriding it.
Leave a Reply