Data Sovereignty in Digital Platforms

Data sovereignty is the principle that data is governed by the laws and customs of the people and place from which it originates. For tribal nations, indigenous data sovereignty extends that principle to data about citizens, lands, language, knowledge, and ceremony. The CARE Principles for Indigenous Data Governance — Collective benefit, Authority to control, Responsibility, and Ethics — were published in 2020 by the Global Indigenous Data Alliance to give tribes a vocabulary for what it means to govern data on their own terms, complementing the more widely known FAIR principles already in use across academic and commercial research.

Architecturally, sovereignty pushes decisions outward from the application into the infrastructure. Where is the database physically hosted? Whose contract is the hosting on? Who actually holds the encryption keys? Which jurisdiction's courts can compel disclosure, and under what process? A tribally owned domain pointed at a US commercial cloud is not the same as a tribally owned domain on infrastructure procured by the tribe directly. Vendor terms of service, data processing agreements, sub-processor disclosures, and law enforcement access policies matter as much as the application code — sometimes more.

The post-Schrems II environment in Europe and the patchwork of US state privacy laws have made the same questions urgent for non-tribal institutions, but tribal nations have been thinking about them for far longer. The platforms we build for tribal clients tend to share four properties: hosting that the tribe directly controls or independently audits, encryption keys the tribe holds and can rotate without vendor cooperation, a transparent log of every administrative action against the system, and a clear process for the tribe to take possession of all data and operate the platform fully in-house at any time, with no contractual or technical lock-in. Sovereignty without an exit ramp is not actually sovereignty.