Principles-and-Practices

Part I — Foundation

About this Synthesis

Where this synthesis comes from

This synthesis names the principles and practices that recur across two bodies of work: ten Tribal interviews conducted by Michael Wilson, VPDC's Indigenous Data Sharing Program Manager, and a review of 39 sources in the Indigenous Data Sovereignty literature by David Diaz, VPDC's Forest Data Scientist.

The literature defines Tribal data broadly — data on or about Tribal peoples, lands, places, and resources, including data Tribes were not involved in generating and may not control access to. We use that broad definition throughout, because it is the scope the field has converged on. VPDC's adopted commitments today are anchored to a narrower scope within it; we describe how we work, what we have committed to, and the direction we are heading on our Tribal Stewardship page →

Tribal voices — ten conversations, honored here

Valuing Indigenous Knowledge: Learning to understand — understanding to learn was written by Michael Wilson, a member of the Confederated Tribes of Grand Ronde and VPDC's Indigenous Data Sharing Program Manager. His paper draws on decades of professional work in natural resources and on interviews and conversations with tribal council members, natural resource and cultural professionals, and tribal elders.

Read the full paper

The Indigenous Data Sovereignty literature — 39 sources

Authored by David Diaz, VPDC's Forest Data Scientist. A structured review of 39 sources — peer-reviewed studies, policy instruments, federal and tribal agency guidance, practitioner protocols, and applied case studies — synthesizing what the field has learned about Indigenous Data Sovereignty and governance across the last two decades, with particular attention to North American contexts. AI was used to assist with the generation of initial source summaries; all sources and summaries were reviewed and verified by the author.

Download the annotated bibliography (PDF)

We're making this synthesis public for partners considering work with Tribes, practitioners looking for grounded guidance, funders weighing investments in this space, and Tribal Nations considering whether and how to work with us.

Foundational Principles

Seven principles where tribal voices and the literature meet

Seven principles converge across both source bodies — the ten tribal interviews and the 39 Indigenous Data Sovereignty sources. Together, they describe the ground beneath any credible engagement with Tribal data or Indigenous Knowledge.

01

Sovereignty is the frame, not a courtesy.

Tribal Nations are sovereign, with the authority to govern their lands, people, and data. Sovereignty reflects individual and collective rights and expectations, recognized through treaties and reaffirmed across generations of tribal work to defend them. The interviews describe sovereignty as something Tribal members live and protect daily1; the literature grounds the same frame in international rights instruments and national governance frameworks2,3,4.

02

Sensitive information should not be forced into disclosure.

Sacred sites, ceremonial practices, the exact locations of cultural resources — these cannot be extracted through procedural pressure. The interviews document the Yakama Nation's opposition to sharing cultural site locations with the Department of Energy, because once disclosed, information can flow through public records processes beyond the Tribe's control1. The literature documents a closely parallel case: the same Yakama Nation's encounter with the Federal Energy Regulatory Commission on the Goldendale pumped-hydro project, where meaningful consultation was conditioned on disclosing why a place is sacred5,6. Both cases reveal the same structural trap: disclosure demanded in exchange for the chance to protect what disclosure itself would harm.

03

Relationships take time — and the pace is not the partner’s to set.

The interviews describe family networks spanning four or more generations, obligations outsiders cannot see, and a working pace shaped by responsibilities that predate and outlast any single project1. The literature names the same reality institutionally: working at the speed of the community7, multistage partnership life cycles8, and consultation relationships monitored across decades rather than quarters9.

04

Knowledge is rooted in relational context.

Tribal author George Aguilar Sr. describes fishing the Columbia River rapids where his father drowned: “To this day the bones of my father lie at the bottom of this stretch of water.” Aguilar's knowledge of that river is not the same thing as the information such knowledge could be reduced to1. The literature arrives at the same ground from a policy direction: engagement with Indigenous Knowledge and Traditional Ecological Knowledge requires its own protocols for access, protection, and decisions about what may be recorded or made public6,10,11,12.

05

Government-to-government is the framework that governs Federal and State engagement with Tribal Nations.

When Tribal Nations engage with Federal and State governments, they do so as sovereigns. One case drawn from the interviews — Oregon Senate Bill 770 — describes what this looks like in practice: quarterly structured meetings between State agencies and Tribal managers, producing the long-term relationships where issues can be caught early and addressed in good faith1. The literature documents the policy infrastructure underneath such relationships: Federal Trust Responsibility13, Forest Service tribal engagement roadmaps14, and decades-long consultation monitoring9,15. The framework's relevance extends beyond the two parties to it. Researchers, consultants, NGOs, and private partners regularly do work that touches the agency–Tribe relationship, and these non-governmental actors should respect government-to-government as the context that conditions how that work proceeds — what consultation it requires, what it cannot substitute for, and what counts as a credible role for third parties operating around it.

06

Attitudes about sharing are complex and diverse; the right to decide rests with tribal knowledge-bearers.

Among tribal knowledge-bearers, views on information sharing differ — and the differences are real, not problems to be resolved into a single position. The interviews name this directly: some hold knowledge close; others, like Dr. David Lewis of the Confederated Tribes of Grand Ronde, see a responsibility to share accurate information with those genuinely interested in learning1. The literature maps the same spectrum at the institutional level, ranging from two-eyed-seeing and braiding approaches6,16 to stronger boundary-setting approaches that treat knowledge sharing as optional and risk-bearing10,17.

07

The past is load-bearing in the present.

Eras and tribal experiences spanning treaty-making, removal and reservation, allotment and assimilation, termination, and self-determination are not just a historical backdrop. The interviews walk through how each still shapes tribal governance, land tenure, and tribal members' daily lives.1. The literature documents the same truth from additional angles: checkerboarded and fractionated land ownership18; research as a historical instrument of imperialism19; climate change as intensified colonialism20; data dependence as a colonial legacy21.

Part II — In Practice

Five domains where the principles take operational shape: preparation, knowledge, agreements, technology systems, and reciprocity.

Preparing to Engage

Preparation, and honoring self-determination

Preparation is the first requirement. Across the interviews and the governance literature, engagements that begin before the right people are involved and the right questions are addressed tend to fail — or to succeed in ways that don't hold. The practices below describe what preparation involves and where decision authority rests.

Words matter — ask, don’t assume.

How to refer to individuals and collectives when working with Tribal members is something language shifts around — across Tribes, across time, and across what any given Nation calls itself in a given decade1. Guidance from the interviews is concrete: look to how the Tribe refers to itself in its own publications, speeches, and media. When in doubt, ask directly. Most Tribal members will not mind the question and will appreciate the care behind it. This is a protocol the governance literature largely leaves implicit — treat it as explicit.

Define who decides before the project begins.

Before any work involving Tribal data or knowledge begins, identify the Tribal decision-makers — leadership, program staff, cultural authorities — and clarify which decisions require formal approval, at what level(s). Ambiguity about decision rights is not a technical problem to solve later. It is a relationship problem, and relationship problems compound until they stop the work7,8,22. Give this the time it takes before anything else begins, and be prepared to revisit and reinvigorate this relationship as the individuals in these roles and the roles themselves may change.

Consent at the right level — and often more than one level.

Individual consent and standard institutional review are often not enough when risks and benefits land at the community or Nation level19,22,23. Tribal Nations, not individual members, hold authority over collective matters1. Plan for Tribal Nation oversight and collective decision processes from the start — not as appeals filed after a problem surfaces.

Do not self-invite.

The advice is simple and recurs everywhere: be invited, or seek the invitation to tribal events through mutual contact. Do not show up to events intended for members of an individual Tribe or for intertribal activities that are not open to the public. When you do show up, listen. Respect Tribal protocols for who speaks and in what order. If a community does not wish to engage — whether by formal refusal or by not responding — accept the decision and do not press7,17.

Working with Knowledge

How Indigenous Knowledge and Traditional Ecological Knowledge are handled

Knowledge is not data. The interviews and the literature are emphatic on this: Indigenous Knowledge and Traditional Ecological Knowledge are held, shared, and protected under terms that standard data practices routinely violate.

Design for “no.”

A real partnership must make it genuinely possible for knowledge keepers to decline sharing, keep knowledge local, or redirect or end a project. If the engagement process does not support “no” as a real outcome — if refusal creates friction and compliance creates ease — then the process is not a process. It is a pipeline10,17. "No" has to be as easy as "yes," and withdrawal has to be as supported as collection.

Minimize collection; separate sensitive categories.

Determine at the outset what should be excluded from non-tribal access or collection — and flag the sensitive categories (ceremonial knowledge, site locations, genealogy, culturally significant species and places) for separate handling from the start5,6,9. At the same time, recognize that the scope and details of knowledge-sharing on appropriate topics may evolve through successive iterations and refinements. Tiered access and separation of duties need to be in the design, not bolted on once the data is already on disk. What is not collected cannot be leaked, subpoenaed, or misused. Minimization is a design discipline, not a fallback.

Signal protocols within digital systems.

When Indigenous data moves through mainstream repositories, catalogs, or APIs, metadata about rights and governance has to travel with it. Traditional Knowledge (TK) Labels and the Local Contexts platform are established mechanisms for making that happen24,25. Native Land Digital's Data Sovereignty Treaty shows how terms-of-use can function as governance instruments in their own right26. These are the tools that turn sovereignty from a commitment into something an information system actually reflects.

Agreements and Accountability

Making expectations enforceable, and visible

Written agreements make shared understanding durable. Across both interviews and the literature review, agreements are the threshold where good intentions become enforceable commitments — and their specificity matters: what they cover, how they are co-designed, and how they anticipate the legal realities that surround tribal data.

Written agreements early, co-designed by the partners.

A data-sharing agreement has real work to do: name who owns the data and who holds custody, spell out what can be done with it and what cannot, define access controls, set retention windows and deletion triggers, reserve publication review rights, and determine acceptable downstream reuse4,22. The agreement should be co-designed and revised as the relationship changes, because relationships change. An agreement that only protects the interests of one side is not an agreement. It's a contract of convenience waiting to fail.

As open as determined by Indigenous communities.

What will be open, what will be restricted, and what will not be collected or published at all — these belong in writing, before collection begins, not after. The canonical framing from the literature — "as open as determined by Indigenous communities"3,25,27 — is not a modification of Open Science principles. It is the precondition for applying them to Indigenous data at all. Openness is a decision the community makes, not a default the project inherits from Open Science convention.

Plan for public-records dynamics.

Federal and State legal frameworks — such as the Freedom of Information Act, permitting records, consultation documentation — can create disclosure obligations that conflict with Tribal partners' confidentiality needs. Once sensitive information has changed hands, the legal machinery around it is often outside the project's control. The literature is explicit: plan for these dynamics in advance, with counsel, before anything sensitive moves5,6.

Technology and AI

How sovereignty is implemented in the systems where data lives

Sovereignty is not self-executing. It may be protected or diminished in access controls, schema choices, model training pipelines, and the provenance metadata — in any line of code and any infrastructure decision that touches Tribal data. Good intentions do not survive contact with a misconfigured S3 bucket. The interviews and the literature are clear on this: the work of honoring sovereignty in technical systems is a design discipline, not a disclosure statement.

FAIR + CARE: the two principles together

The FAIR principles — Findable, Accessible, Interoperable, Reusable — are embraced as the foundation of Open Science. These principles should not be applied automatically to Indigenous data except where they are intentionally chosen through self-determination and informed consent. The CARE principles — Collective Benefit, Authority to Control, Responsibility, Ethics — make explicit what FAIR implies25,28,29. FAIR asks whether others can find and use data; CARE asks whether they should, and on whose terms.

Layered access controls as a design discipline

Access is not one decision — it's many. Raw datasets, analytical outputs, and the derived artifacts that flow from them (models, feature stores, embeddings, synthetic data) each need their own controls, because each carries different risks of re-identification and misuse5,9,15. Tiered access is how sovereignty becomes enforceable in a system that otherwise defaults to "make it queryable." Who can reach what, under what conditions, and for how long — these belong in the system's architecture, co-determined by the partners at the outset, not bolted on after launch.

Retention, deletion, and what happens when partnerships change

Partnerships end. Some pause. Others evolve into something different than what was first signed. Agreements need to answer what happens to the data, and to everything built from the data — reports, features, models — at each of those moments4,22. How long is it kept? What triggers deletion? Who decides, and in what timeframe? A data policy without a deletion plan is not a policy. It's an assumption that partnerships last forever, which is one of the few things we can reliably predict they won't.

Provenance and metadata carry accountability forward.

The context around a dataset's origins has to travel with it — across forks, across teams, across the staff turnover that eventually hits every organization24,25. Where the data came from, under what agreement, with which restrictions: these facts shape every future decision about reuse. Without them, the person asking "can I use this for X?" five years from now is guessing. And guessing is how consent erodes. Provenance metadata is the paper trail that keeps accountability attached to the data after the people who negotiated the original agreement have moved on.

Co-define success before building the model.

"Good outcome" is a governance question before it is a technical one. Before touching a model, establish mutual agreement on what success actually means — in what language, at what scale, for whose benefit. Default metrics (deficit indicators, accuracy against a conventional benchmark, engagement-as-success) often describe problems Tribal Nations did not ask to have solved— and reflect frameworks that originated outside tribal priorities.21,30,31. A model that optimizes for the wrong target is not "almost there." It is a different model than the one that was needed.

Treat model training as secondary use.

Consent for collecting data is not consent for training and deploying a model with that data22,23,28. Fine-tuning requires its own consent. Reuse across projects requires its own consent. Each is a separate governance question with its own scope, its own conditions, and its own way to end it. Decide with the partner Nation, up front, what can be built from the data and what cannot — and put the answer in writing before the first training run.

Derived artifacts can still carry sensitivity.

A model trained on sensitive data is still shaped by those data, even when the raw data are locked away23,28. Derived features can reveal patterns. Embeddings can encode identity. Model weights can be probed. Synthetic data generated from a population of 200 is not the same kind of protection as synthetic data generated from 200,000. Which derived artifacts leave the system, who can use them, and under what controls — these are questions to settle before the artifacts exist, not after a researcher asks for the model checkpoint.

Plan for misuse and incident response.

Data get misread. Analyses get cited out of context. Systems get breached26,27. Plan for all three. That means: the ability to pause access quickly, revoke use when needed, and — the hardest one — pick up the phone and call the partner yourself when something has gone wrong, before they hear about it from someone else. This is not defensive engineering. It is respect, made operational.

Reciprocity and Give-back

Honoring what is received

Reciprocity is one of the most practically consequential questions in this work: how is value returned for what is given? The interviews and the literature treat reciprocity as an institutional design requirement — not a line item in a closing gift, and not an afterthought to the work itself.

“Can we pay for knowledge?”

The interviews address this question directly, with a nuance the formal literature does not supply1. Some exchanges are appropriately market-transacted: a hunting guide on the Mescalero Reservation, a Yakama fisherman selling salmon along the Columbia River. In those cases, paying respectfully for the service is exactly right.

Traditional Knowledge passed across generations is something else. One interviewee likens it to a great-great-grandmother's recipe — a thing that survived because it was carried carefully, not because it was priced correctly. What the holder of such knowledge usually wants in return is not cash. They want to know the knowledge was handled with care. They want to know the feelings and history wrapped around its telling were understood. They want assurance the knowledge won't end up on social media, or resold, or stripped of the relationship that made keeping and sharing it possible. When the question of compensation comes up, the first move is to ask. The second is to accept that the answer may be slower, more relational, and less transactional than a financial exchange — and that this is the point, not a limitation.

Reciprocity as an institutional requirement.

Reciprocity is a design requirement, not a gesture. The governance literature is consistent on this: partnership only holds where value flows back in forms the community itself defines7,8,12,32,33. Budget for give-back from project inception — and let tribal partners say what give-back looks like. It might be capacity investment. It might be infrastructure. It might be data returned in a form people can actually use, or sustained relationships across years, or something no one on the project team would have thought to offer. It will not reliably be what was predicted in a funding proposal.

Budget for Tribal capacity and continuity.

Across the literature, "good data" practice requires sustained capacity — staffing, tools, training, infrastructure, institutional continuity — not a one-time deliverable30,31,34. Sovereignty without the infrastructure to exercise it is sovereignty on paper. A Nation that receives a dataset but lacks the staff, the systems, or the institutional continuity to steward it hasn't gained sovereignty over that data — they've gained a maintenance burden. Project budgets need to fund the capacity that makes sovereignty real, not just the technical work that produced the deliverable.

Part III — Where to Begin

From principles to practice — six concrete starting points.

where to begin

A practical starting checklist

In his literature review, David proposes six items as a "practical starting checklist" — what he calls minimum viable governance for developers entering work with Tribal data. We reproduce those items here as field guidance distilled from the literature, made practical. They apply most directly to data that Tribes and Tribal members provide in collaboration with us — the engagement zone described at the top of this synthesis. They do not represent the full scope of what the literature recommends, and they are not a substitute for the relationship, consultation, and slower work the principles above describe.

Define scope and data categories.

What will be collected, what will not, and what is treated as sensitive. Sensitive categories receive separate handling from the beginning.
Document decision rights.

Who approves collection, storage, access, publication, and model deployment — and at what level of Tribal authority. Ambiguity here is eliminated before work begins.
Commit to reciprocity from the outset.

The forms reciprocity will take — data products, training, capacity building, co-authorship, compensation, long-term relationship — are identified and agreed before work begins, not after.
Execute a written agreement.

Covering permitted uses, prohibited uses, retention and deletion terms, publication review rights, downstream reuse restrictions, and enforcement. Co-designed with each partner Nation.
Design access tiers.

Distinguishing restricted raw datasets, restricted analytical outputs, and separate controls on derived artifacts including models and synthetic data.
Write provenance and reuse documentation.

Recording data lineage, training data sources, and downstream reuse conditions so future decisions are not made in ignorance of original terms.
Plan for withdrawal and termination.

Specifying how the project changes or ends, and what happens to data and artifacts when it does.

Beyond this synthesis

The work still underway

The checklist above describes procedural artifacts — agreements, access tiers, provenance documentation, termination terms — that operationalize Indigenous Data Sovereignty in everyday workflows. VPDC's adopted commitments today describe how we show up in tribal partnerships, and are listed on our [Tribal Stewardship page →]. Building out the full set of procedural artifacts described above, alongside our sister organization Vibrant Planet PBC, is active work — the focus of the Cisco Foundation–funded protocols this synthesis supports, and the standard we are working toward as our practice matures.

Acknowledgments

With gratitude to those whose work made this possible

This synthesis could not have been written without the Tribal members, professionals, and Elders who shared their experience with Michael Wilson. While he has respected the confidentiality of personal conversations, the Tribes and Peoples represented in his interviews include the Confederated Tribes of Umatilla Indian Reservation, the Kalispel Tribe of Indians, the Sault Ste. Marie Tribe of Chippewa Indians, and Peoples including the Kalapuya, Umpqua, and Chinook — along with board members from a regional Land Trust and Soil and Water Conservation District. We are grateful for their time and for the trust their contributions represent.

The literature review synthesizes work by many scholars, practitioners, and institutions. Our particular debt is to the authors of the CARE Principles and to the Indigenous Data Sovereignty movement whose work underlies much of the framework's scaffolding, and to the Federal agencies, Tribal organizations, and practitioner networks whose guidance documents gave the field its operational shape. This review was conducted with the assistance of artificial intelligence (AI) in the generation of summaries. All resources and the AI-generated summaries of them were reviewed by the literature review author, David Diaz.

Source Materials

Read the sources behind this synthesis

The principles and protocols above are grounded in two bodies of work. Both are available in full for readers who want to go deeper than citation numbers allow.

Tribal voices

Valuing Indigenous Knowledge

Michael Wilson's full paper, Learning to understand — understanding to learn. Informed by 10 interviews and conversations with Tribal council members, natural resource and cultural professionals, and Tribal Elders.