Skip to main content

Includovate

Menu

Data sovereignty and the contract that says nothing

Kristie Drucza

A donor puts out a call for proposals. It covers sample sizes, deadlines, reporting templates, and a budget line for “data collection.” What it does not mention is who owns the data once it is collected, who decides how it is stored, or whether the community has any way to withdraw or correct information gathered about them. A firm wins the contract and has to decide, quietly, what to do about the gap.

Includovate is a small, majority-women-led research firm built on contracts with low- and middle-income researchers and on thin margins. Every clause we do not push for is a risk we are quietly absorbing on someone else’s behalf. This happens more often than it should, because most donor funding instruments were built for financial accountability to the donor, not for Indigenous Data Sovereignty (ID-SOV). So the real question is not whether data sovereignty matters. It is whether a contracted firm has a duty to raise it when no one asks, and what that duty should look like when the firm is small, dependent on the contract, and answerable to researchers whose income depends on the work continuing.

This post, the first of two on data sovereignty and contracted firms, is written from that perspective.

A firm facing this in practice

Take a hypothetical but common scenario. Firm X, a ten-person evaluation consultancy, wins a two-year contract to evaluate a livelihoods programme in a Pacific Island community. The terms of reference specify sample sizes, a reporting template and a data collection budget line. It says nothing about who owns the household survey data once collection ends, whether the community can see the findings before the donor does, or what happens to the dataset after the contract closes. Midway through the evaluation, the donor’s communications team asks Firm X to share raw transcripts, including named case stories, for a global campaign report, a request that falls well outside what participants understood they were agreeing to when they gave their consent. Firm X now has days, not months, to decide whether to comply, push back, or find a middle path, with a lead evaluator whose next three months’ income depends on the donor relationship staying smooth. This is the point where sovereignty stops being an abstract principle and becomes a decision someone has to make before lunch.

Why this is not a side issue

A community data sovereignty assessment asks whose interests data governance actually serves. It looks at whether a community, often Indigenous or First Nations but the idea extends to any disadvantaged or under-resourced group, keeps ownership, control and decision-making power over data collected about them, their land, their culture or their programmes. The main reference point is the CARE Principles for Indigenous Data Governance: Collective Benefit, Authority to Control, Responsibility and Ethics, set out in 2019 by the International Indigenous Data Sovereignty Interest Group of the Research Data Alliance to sit alongside the more technical FAIR principles (Wikipedia, 2024). Where FAIR asks whether data can be found and reused efficiently, CARE asks who benefits from that reuse, who authorised it, and who answers for it if things go wrong (Carroll et al., 2020).

Article 31 of the UN Declaration on the Rights of Indigenous Peoples backs this with something closer to law. It recognises Indigenous peoples’ right to “maintain, control, protect and develop” their cultural heritage, traditional knowledge and intellectual property, data included (First Nations Development Institute, 2023). This is not theoretical. The First Nations Development Institute’s 2023 review of philanthropy and Indigenous evaluation found a consistent pattern: Native people left out of datasets altogether, brought into research as an afterthought, or asked to report against indicators that were never theirs to begin with. Funder-set formats, English-only requirements and predetermined success measures routinely override what a community actually values or needs to know, producing data that satisfies a donor’s reporting template while telling the community little of use, or worse, framing them in ways they find stigmatising. Governments are beginning to formalise this commitment too: Australia’s Department of Foreign Affairs and Trade’s 2026 First Nations International Engagement Strategy commits to upholding UNDRIP “by actively engaging in multilateral and regional forums that promote Indigenous Peoples’ rights” (Department of Foreign Affairs and Trade, 2026), a sign that the sovereignty questions this piece raises are moving from advocacy literature into mainstream donor country policy.

Researchers at a small consultancy discuss whether to share community data requested by a donor.
AI Generated Image

The Havasupai Tribe’s case against Arizona State University shows what can happen when consent is treated as a form rather than an ongoing conversation. Blood samples collected for a diabetes study were later used, without the tribe’s knowledge, for research into schizophrenia, inbreeding and migration theories that contradicted the tribe’s own origin stories. The case settled in 2010: $700,000 in compensation, the samples returned, and an admission of harm, though no binding legal precedent (Stanford Law School, 2010). The lesson it left behind still holds: consent is a process, not a signature, and harm can occur even when a researcher followed every procedural box. That lesson does not stay confined to biological samples.

What has changed since 2010 is scale and speed. AI-assisted transcription and analysis now let a single firm process, tag and cross-reference years of qualitative material in days rather than months, which multiplies how far a person’s words can travel from the moment and context in which they gave consent.

The same pattern shows up in ordinary qualitative and evaluation work: interview transcripts, survey responses, and case stories collected for one purpose and reused, republished, or reframed for another, without the participant knowing. A survivor’s account given for a programme evaluation can resurface in a donor report, a conference paper or a public case study, sometimes stripped of context or reshaped to make a stronger case for continued funding. Qualitative data is not exempt from the same sovereignty questions that blood samples raise, because it carries the same risk: people consent to a specific use, at a specific time, for a specific audience, and lose control the moment the data outlives that use.

This has become harder to ignore, not easier. Since USAID’s funding cuts and effective shutdown in mid-2025, the quality of aid, how sustainable its results are, and who remains accountable for them have all come under sharp scrutiny, with independent analysis estimating the cuts will cause millions of preventable deaths and strip the data systems of affected countries of a major source of support (Stanford Social Innovation Review, 2026; Development Gateway, 2026). In that scramble, data sovereignty has tended to slide down the list of priorities, treated as a nice-to-have rather than a load-bearing part of the debate. That is the wrong order. Questions about who controls aid data, who it serves and who is accountable to whom sit at the centre of the argument over what happens after a major funder withdraws, not at the edge of it.

Three ways a firm can respond, and what each one costs Stay strictly within scope.

The firm delivers what the contract specifies and treats governance questions as the donor’s problem, not a vendor’s. This is the most common response, mostly because it is the safest for the relationship and the invoice. It is also how extractive practice becomes routine. BetterEvaluation’s ethical protocol for evaluation in Aboriginal and Torres Strait Islander settings lists “facilitate control and data sovereignty” as one of six ethical domains that sit alongside informed consent and cultural safety, rather than as something contingent on a funder having thought to include it in the terms of reference (BetterEvaluation, 2019). If ethical practice really is non-negotiable, “it wasn’t in the contract” cannot be a good enough answer.

Flag the gap and build in safeguards anyway.

This is the position most Indigenous data governance frameworks point towards. The Lowitja Institute’s ID-SOV Readiness Assessment and Evaluation Toolkit exists so that a research organisation can check its own practice against these principles rather than wait to be told to. Australia’s National Indigenous Australians Agency Framework for Governance of Indigenous Data goes further, asking government bodies to enter into formal data-sharing agreements, appoint internal data sovereignty leads, and hold regular partnership health checks as a standing practice, independent of any single grant (NIAA, 2024). Under this view, a firm that knows the risk and says nothing is not neutral. It has chosen convenience over disclosure.

community-centered illustration shows data flowing toward collective benefit, control, responsibility, and ethical decision-making.
AI Generated Image

Refuse the work.

Some advocacy pushes this far: that firms should decline work where sovereignty safeguards cannot be built in at all. The First Nations Development Institute’s 2023 report does not go this far; it calls for funders to shift power and mould to Indigenous priorities rather than for firms to walk away from contracts (First Nations Development Institute, 2023). But the logic of that report, taken to its conclusion, points toward refusal as one legitimate response. Few firms actually refuse work on these grounds, and for good reason, which is worth taking seriously rather than dismissing as a compromise of principle.

From a risk management standpoint, the cost of inaction is not evenly distributed, and it rarely lands on the donor. If a firm collects data without securing sovereignty protections and that data is later leaked, misused or repurposed in a way a community did not consent to, it is typically the contracted firm, not the donor, that holds the direct relationship with participants, the ethics approval on file, and the reputational exposure if the story becomes public. Donors can distance themselves by pointing to the firm’s methodology; firms cannot do so as easily. Professional indemnity and duty of care obligations generally attach to the party that collected the data, not the party that funded its collection, which means a firm that treats sovereignty as someone else’s problem is quietly carrying legal and reputational liability it did not price into the contract. Framed this way, addressing data sovereignty is not only an ethical position. It is professional risk management, on the same footing as data security or child safeguarding, and arguably cheaper to build in at inception than to manage after a breach.

The part the debate usually skips: what refusal costs the people doing the work

Most of the writing on this topic assumes the firm weighing these options is large enough to walk away from a contract without real consequence. That assumption does not hold for a firm like Includovate. As a small feminist research incubator, much of its purpose is to pay and build the careers of researchers from low- and middle-income countries who would otherwise have limited access to this kind of work. Turning down a contract because a donor did not think to mention data sovereignty is not a victimless act of principle. It can mean a researcher in Ethiopia, Fiji or Timor-Leste loses paid work, and a smaller firm loses margin it may not get back.

This creates a genuine ethical tension, and it deserves to be named rather than argued away. Refusing a contract can look principled from the outside while, in practice, handing the work to a larger firm with fewer scruples and no intention of raising the issue at all. The community is no better off, and the firm’s own researchers are worse off. An absolutist stance that treats any contract silent on data sovereignty as one to reject risks protecting the firm’s conscience at the expense of the very people, staff and communities it exists to support.

So the fairer question is not whether to comply or refuse, but what a firm with limited leverage can still do without abandoning either its principles or its people. That is the subject of the next post: the practical moves available even to a firm that cannot afford to say no, and the standard the sector could set collectively so no single firm has to carry that risk alone.

Researchers weigh community data protection against the financial and employment consequences of refusing a donor contract.
AI Generated Image

References

0
    0
    Your Cart
    Your cart is emptyReturn to Shop
    Skip to content