Kristie Drucza
In the first post in this series, I argued that when a contract says nothing about data sovereignty, silence is not neutral. A firm that notices the gap and says nothing has made a choice, even if no one asked it to. But naming the problem is the easy part. The harder question, especially for a small firm like Includovate that depends on the contracts it wins to pay researchers in low- and middle-income countries, is what to actually do when refusing the work is not a real option.
The good news is that most of what matters does not require a donor’s permission. A few concrete moves are within reach even for a firm that cannot afford to say no, and together they cover most of what the CARE Principles for Indigenous Data Governance ask for: Collective Benefit, Authority to Control, Responsibility and Ethics.
How the CARE Principles map onto practice
- Collective Benefit. The inception meeting checklist below is requested before signature, so the community’s likely gains from the data are on the table alongside the donor’s.
- Authority to Control. The ownership and storage question in that checklist names who decides what happens to the data once collection ends.
- Responsibility. Safeguards get built into the method itself rather than sitting as an optional budget line, so accountability does not depend on extra funding being approved.
- Ethics. A line does not move: refusing repurposing without renewed consent, even when everything else in the contract has been negotiated away.
Raise it early and cost it low
At proposal or inception stage, before signature, a firm still has some leverage. Naming the gap to the donor and proposing a light-touch community data sovereignty assessment, framed as strengthening the evidence base rather than adding bureaucracy, costs little and sometimes gets funded once a donor sees it as risk management rather than activism.
A short list of questions, asked plainly at the inception meeting, does most of this work without requiring a formal negotiation:
- Who owns the data once collection ends, and where will it be stored after the contract closes?
- Will the community or participants see the findings before, or only after, the donor does?
- Is there a process for participants to review, correct or withdraw what has been recorded about them?
- If the donor wants to reuse this data for another purpose later, such as a campaign, a case study, or a different evaluation, who needs to approve it, and how will consent be rechecked?
None of these questions requires the donor to have thought about data sovereignty in advance. They simply make the gap visible early, when it is still cheap to close.
Build safeguards into method, not into the budget line
Most of what CARE and Article 31 ask for does not need donor sign-off. A firm can decide, on its own authority, who is consulted on what data is collected and how, whether findings go back to the community in a usable form rather than only upward into a donor report, and whether there is a way for the community to correct or restrict what is recorded about them (First Nations Development Institute, 2023). None of this requires permission. It requires discipline in how the methodology is written and applied.
Be honest about the limits
Where a firm genuinely cannot secure a formal data-sharing agreement because the donor will not fund or authorise one, the honest move is to say so, in writing, to both the donor and the community, rather than imply protections that do not exist.
Keep a line that does not move
There is a difference between a donor who has simply not thought about data sovereignty and one who, once informed, insists on practices the firm knows to be harmful, such as blocking community access to findings or demanding publication in a form the community has rejected. The first is an oversight worth fixing quietly. The second is where continuing the work stops being neutral delivery and becomes participation in the harm.
This is a more modest position than never signing a contract that ignores data sovereignty. It accepts that a small firm operating on thin margins, with staff and consultants who depend on the income, cannot always take the harder line that a well-resourced institution can. What it insists on instead is that silence in the contract is never mistaken for silence in the method, and that raising the issue, however lightly, is still worth doing even when refusing the work is not an option.
Where this lands
For a firm already working in participatory and feminist evaluation traditions, this is not really a new demand. Facilitating community control over data is a direct extension of the same commitment to shifting power towards the people being studied that participatory and feminist methods already claim. The honest gap for most firms is not conceptual. It is procedural, and it is financial: building a lightweight sovereignty check into inception work by default, even when the donor never asked, while being realistic that a small firm’s leverage to refuse work is genuinely limited, and that the people who lose out when contracts are declined are often the same disadvantaged researchers the firm was set up to support in the first place.
This is less hypothetical than it sounds. Australia’s National Indigenous Australians Agency already directs government agencies to “review templates for contracts and funding agreements … to ensure funded organisations collect and manage data” in line with its Framework for Governance of Indigenous Data, and publishes model contract clauses for exactly this purpose (National Indigenous Australians Agency, 2024). Local Contexts, a global initiative built with Indigenous communities, offers a related tool already used by researchers and institutions: Traditional Knowledge and Biocultural Labels that accompany a dataset and state, in machine- and human-readable form, who must be consulted before it is reused (Local Contexts, 2026). Neither was designed specifically for evaluation contracts, but both show that standardised, reusable sovereignty language is not a proposal; it is an emerging practice waiting to be adopted.
That imbalance is not something any single small firm can fix by raising its hand alone, contract by contract. It would help more if evaluation and research networks, professional associations and donor consortia did the work once, collectively, by developing a standard data sovereignty rider, a short, ready-to-insert contract clause covering ownership, community review and withdrawal rights, that any firm could attach to a proposal without having to draft it, defend it or absorb the cost of being the first to ask. Standardising the ask would lower the price of raising it, and that, more than any individual firm’s conscience, is what would actually shift the norm.
Until then, Includovate will keep applying its own community data sovereignty checklist and guidance at inception on every project, whether or not a donor asks for it. Every research proposal already goes through ethical clearance covering consent, privacy and confidentiality, but we have now made that clearance explicitly ask data sovereignty questions too, rather than leaving them implied. It is a small procedural change, and it is the one within our control.
References
First Nations Development Institute (2023) Indigenous Data Sovereignty and Indigenous Evaluation. Available at: https://www.firstnations.org/wp-content/uploads/2023/04/Indigenous-Data-Sovereignty-and-Indigenous-Evaluation-2023.pdf
Local Contexts (2026) Indigenous Data Sovereignty Agreement. Available at: https://localcontexts.org/indigenous-data-sovereignty/
National Indigenous Australians Agency (2024) Framework for Governance of Indigenous Data. Available at: https://www.niaa.gov.au/sites/default/files/documents/2024-05/framework-governance-indigenous-data.pdf