Indigenous Data Sovereignty: OCAP Principles for Research

What Is Indigenous Data Sovereignty?

Indigenous data sovereignty is the principle that Indigenous peoples have the right to govern the collection, ownership, and application of data about their communities, lands, cultures, and members. In Canada, this is most concretely expressed through the OCAP principles. Ownership, Control, Access, and Possession, developed by the First Nations Information Governance Centre (FNIGC). These principles assert that First Nations communities own their collective data, control how it is collected and used, have the right to access data about themselves, and should physically possess that data. Indigenous data sovereignty challenges the default research paradigm where external researchers collect data from communities and retain ownership of the results.

Who Needs to Comply?

• Research teams conducting studies involving First Nations, Inuit, or Metis participants or communities in Canada
• Government departments and agencies commissioning research about or with Indigenous peoples
• Academic researchers: the TCPS 2 (Chapter 9) requires specific engagement with Indigenous communities for research involving them
• Market research agencies contracted for studies that include Indigenous populations or communities
• Survey platforms used to collect data from Indigenous participants, especially when data governance agreements specify community control over data storage and access
• Health researchers: Indigenous health data is subject to both health privacy legislation and community data governance expectations

Gray areas: Indigenous data sovereignty applies most directly when research is conducted with Indigenous communities or about Indigenous-specific topics. General population surveys that happen to include Indigenous respondents raise different questions, community-level governance may not apply to individual survey responses, but researchers should still consider whether their data collection practices respect Indigenous data rights. The principles are evolving, and specific requirements vary by community, nation, and research context. There is no single legislation that codifies OCAP, compliance is relationship-based and community-specific.

Key Requirements for Research Teams

Ownership

Data about First Nations communities belongs to the community collectively, just as individual data belongs to individual people. This challenges the conventional research model where the researcher or commissioning organization owns the data. In practice, ownership means that research agreements should specify community ownership of data collected about or from the community. The community, not the researcher, not the funder, not the platform, decides how the data is used, shared, and stored. For survey research, this may mean that aggregate results, raw datasets, and analytical outputs are all owned by the participating community.

Control

First Nations communities have the right to control all aspects of data management and research processes that affect them. This includes control over the research design (what questions are asked, how data is collected), data management (how data is stored, who accesses it), and data use (what analyses are conducted, how findings are reported, whether data is shared externally). Control does not mean that external researchers cannot be involved, it means that community governance bodies approve and oversee the research process. Research ethics boards increasingly require evidence of community engagement and approval, not just individual participant consent.

Access

Communities must have access to data about themselves, regardless of where the data is held or who collected it. This means providing communities with their data in usable formats, ensuring communities can access results and analyses (not just raw data), and removing barriers to access such as paywalls, proprietary formats, or technical complexity. For survey research, access provisions should be built into the research agreement, specifying what data and reports will be provided to the community, in what format, and on what timeline.

Possession

Physical possession of data is the practical mechanism through which ownership and control are exercised. When data is held by an external organization, the community's ability to exercise ownership and control depends on the goodwill and compliance of that organization. OCAP's possession principle asserts that data should be physically held by the community or by an entity the community trusts and controls. For digital research data, this translates to data storage under community governance, whether on community-owned infrastructure, in a trusted third-party environment with community-controlled access, or through data governance agreements that give communities the ability to direct data handling.

Community Engagement and Research Agreements

Meaningful engagement with Indigenous communities must begin before the research design is finalized, not after. Research agreements should be developed collaboratively and should address: the research purpose and how it benefits the community, community involvement in research design and question development, data ownership and governance, data storage and access provisions, reporting and dissemination plans (including community review of findings before publication), intellectual property rights, and capacity building for community members. These agreements are typically negotiated with community governance bodies (band councils, tribal councils, community research committees) and may take months to develop.

The TCPS 2 Framework (Chapter 9)

Canada's Tri-Council Policy Statement dedicates Chapter 9 to research involving First Nations, Inuit, and Metis peoples. It requires engagement with the relevant community before research begins, collaborative development of research agreements, respect for community customs and codes of practice, and recognition of community rights to data. For federally funded research, Chapter 9 compliance is mandatory. Even for non-federally-funded research, Chapter 9 provides the ethical framework that REBs use to evaluate proposals involving Indigenous communities.

Compliance Checklist

• Identified whether the research involves Indigenous communities, populations, or Indigenous-specific topics
• Engaged with the relevant community governance body before finalizing the research design
• Developed a collaborative research agreement addressing OCAP principles
• Community ownership of data is documented in the research agreement
• Community control over research design, data management, and dissemination is established
• Access provisions specify what data and reports the community will receive and in what format
• Data possession arrangements ensure the community can direct data storage and handling
• Community review of research findings is built into the publication/reporting timeline
• Individual informed consent is obtained in addition to community-level authorization
• Research instruments (surveys, interview guides) have been reviewed and approved by community representatives
• Capacity building or knowledge-sharing commitments are included in the research agreement
• REB submission addresses TCPS 2 Chapter 9 requirements for research involving Indigenous peoples

How This Compares to Standard Research Ethics

How Quali-Fi Helps You Comply

Quali-Fi supports research that respects Indigenous data sovereignty through platform features aligned with OCAP principles. Data residency controls allow research data to be stored in Canadian data centres, and project-level access configurations can be set to give community-designated representatives direct access to their community's data, supporting the access and possession principles. Role-based permissions ensure that community governance contacts can view, export, and manage data about their community without requiring the research team to act as an intermediary.

The platform's consent management tools support the multi-layered consent model that Indigenous research requires, community-level authorization documented through research agreements, plus individual participant consent captured through the survey flow. Both consent layers are timestamped and logged for audit purposes. Survey instruments can be collaboratively developed using Quali-Fi's design tools, and community representatives can review and approve questionnaires before deployment.

Quali-Fi's encryption (AES-256 at rest, TLS 1.3 in transit), audit logging, and SOC 2 Type II certification provide the security infrastructure that community data governance agreements require. For government departments and agencies conducting research with Indigenous communities, a significant segment of Quali-Fi's client base, the platform provides the compliance foundation for both standard privacy requirements (PIPEDA, provincial laws) and the community-specific data governance obligations that OCAP principles demand.

FAQs

Are OCAP principles legally binding?

OCAP principles are not enshrined in federal or provincial legislation in the way that PIPEDA or PHIPA are. However, they are recognized in the TCPS 2 (which governs federally funded research), increasingly referenced in government research procurement requirements, and enforced through community research agreements. Many REBs will not approve research involving Indigenous communities that does not address OCAP. The principles carry practical force even without a specific statutory mandate.

Do OCAP principles apply to all Indigenous research in Canada?

OCAP was developed by and for First Nations communities specifically. Inuit and Metis communities have their own data governance frameworks, the Inuit Tapiriit Kanatami has developed the National Inuit Strategy on Research, and Metis communities have distinct governance approaches. While the principles of community ownership and control are shared, the specific frameworks and governance bodies differ. Research teams should engage with the specific community's data governance framework rather than applying OCAP universally.

Can I include Indigenous participants in a general population survey without community engagement?

For general population surveys where Indigenous participants are included as part of a broader sample, the community engagement requirements are different from research specifically about or targeting Indigenous communities. However, researchers should consider whether Indigenous-specific data will be reported separately (which would engage OCAP principles), whether the survey design is culturally appropriate, and whether oversampling Indigenous participants triggers community-level obligations. When in doubt, consult with your REB and relevant Indigenous governance organizations.

How long does community engagement take?

Community engagement for research involving Indigenous communities is a relationship-building process that typically takes months, not weeks. Initial outreach, relationship development, collaborative research design, agreement negotiation, and community review of instruments can take 3-12 months depending on the scope of the research and the community's governance processes. This timeline must be built into project planning from the outset, it cannot be compressed without undermining the principles it is meant to uphold.

What about data from Indigenous communities outside Canada?

Indigenous data sovereignty is a global movement, not uniquely Canadian. In Australia, the AIATSIS Code of Ethics guides research with Aboriginal and Torres Strait Islander peoples. In New Zealand, Maori data sovereignty principles guide research with Maori communities. In the United States, tribal sovereignty provides a legal framework for data governance. The specific principles and governance structures vary, but the core concept, that Indigenous peoples have the right to govern data about themselves, is consistent internationally.

Related Compliance Topics

• Research Ethics Compliance. TCPS 2 and REB requirements
• Consent Management in Surveys. Multi-layered consent design
• Canadian Government Research Compliance. Federal procurement and Indigenous research
• Data Residency for Research. Data possession and sovereignty
• Data Anonymization for Research. Community data protection
• PIPEDA Compliance for Research. Privacy alongside sovereignty