Whose Data Is it? - Indigenous Data Sovereignty and the Smart City

By James Sankar, ASCA President

In March 2026, the OECD convened governments, researchers, and community leaders from Australia and New Zealand for a dedicated forum on Indigenous data sovereignty [1]. The central finding was not technical. It was political, in the deepest sense of that word: when Indigenous people are not involved in defining what data is collected about them, how it is interpreted, and how it is used, the policies that result are less likely to reflect local priorities - and less likely to deliver genuine outcomes.

For those working in smart communities, this finding should land with some weight. Because smart communities, by design, generate data. A lot of it.

"A smart city without Indigenous data sovereignty is a city that has learned to watch without learning to listen."

What Data Sovereignty Means in Practice

Indigenous data sovereignty is the right of Indigenous peoples to govern the collection, ownership, and application of data about their communities, peoples, lands, and resources [2]. It is not a concept that lives only in academic literature or federal policy documents. It has practical implications for every organisation that builds, buys, or operates digital infrastructure in or near First Nations communities.

Australia's National Institute for Aboriginal and Torres Strait Islander Studies (AIATSIS) has developed the AIATSIS Code of Ethics for Aboriginal and Torres Strait Islander Research, which establishes community control over research data as a foundational principle [3]. The National Indigenous Australians Agency's Framework for Governance of Indigenous Data extends this into public administration, asking government agencies to consider how data governance arrangements reflect First Nations priorities rather than institutional convenience [4].

Australia's National AI Plan, released in December 2025, elevates this further. It commits the Australian Government to upholding the NIAA Framework across all its data practices - including AI systems - and explicitly acknowledges that AI has already caused harm to First Nations communities through the perpetuation of stereotypes and the misuse of cultural and intellectual property [5]. Importantly, this is not framed as an aspirational commitment. It is presented as a current governance standard that agencies - and by extension, councils — are expected to apply now.

The Smart City Problem

Modern smart city deployments generate data in ways that are easy to overlook. Environmental sensors on or near Country record conditions of land and water that may hold cultural significance. Mobility platforms map movement through communities whose patterns of movement carry social and ceremonial meaning. Health and wellbeing dashboards aggregate information about residents who may hold specific knowledge about the land those sensors sit on.

In each of these cases, the question of who owns the data, who interprets it, and who makes decisions based on it is not a technical question. It is a governance question. And in most current smart city deployments, the governance answer defaults to the council, the technology vendor, or the data platform - not the community.

The OECD forum made clear that this is not a fringe concern. It is a mainstream policy challenge. Governments that ignore Indigenous data sovereignty in the design of digital systems are building systems that will generate data, and base decisions on that data, in ways that communities have not consented to and cannot control [1].

"A framework is not a practice. The gap between what policy commits to and what procurement actually requires is where data sovereignty is most often lost."

The Institutional Capability Gap

The most important observation from ASCA's conversations with member councils is that the barriers to Indigenous data sovereignty practice are not primarily technical. Councils are not, in most cases, ignoring this issue because the technology is complicated. They are struggling with it because the institutional capability does not yet exist.

Building genuine Indigenous data sovereignty into smart city practice requires several things that most councils do not currently have. It requires knowing who the relevant Traditional Custodians are for the land on which sensors and infrastructure are placed - and having genuine relationships with those communities, not just notification processes. It requires data stewardship agreements that give communities meaningful control over data collected about or near their Country - not just terms and conditions that assume the council's ownership. And it requires procurement criteria that ask vendors directly: how does your system support community data governance?

The five-phase Indigenous Data Governance Framework developed by Australian researchers in partnership with Aboriginal community-controlled health organisations offers a practical model for how this can be implemented incrementally [6]. The framework does not require councils to resolve every question before acting. It asks them to start, to build relationships, and to treat data governance as an ongoing partnership rather than a one-off compliance step.

What Good Practice Looks Like

CSIRO's Digital Futures Roadmap for Northern Australia's Indigenous land and sea managers, developed with the North Australian Indigenous Land and Sea Management Alliance (NAILSMA), Microsoft, and the Telstra Foundation, provides one of the clearest examples of what genuine co-design looks like in practice [7]. The roadmap was built from community-defined priorities, not from technology-first assumptions. Its vision - to empower local Indigenous people to use data, AI, and digital technologies to adaptively manage Country - positions communities as the governors of their own digital futures, not the subjects of someone else's smart city.

In urban contexts, the Greater Sydney Region Plan's decision to name its three city zones after Indigenous Country - saltwater country, muddy river country, and running water country - represents a small but meaningful step toward embedding Indigenous knowledge into planning frameworks [8]. AHURI's research on incorporating Indigenous knowledge into Australian cities shows that councils which engage with First Nations knowledge in the design process, rather than the consultation process, produce more durable and more credible outcomes [9].

The common thread across these examples is not technology. It is relationship. The councils and organisations making progress on Indigenous data sovereignty are the ones that have invested time in building genuine partnerships with First Nations communities before a project begins, not after it launches.

Where ASCA Can Help

ASCA exists, in part, to provide the safe space for exactly this kind of honest, complex conversation. Indigenous data sovereignty is an area where many councils feel uncertain, where the policy landscape is evolving quickly, and where the consequences of getting it wrong - for communities and for councils - are significant.

The ACSA/ASCS 2026 Summit will include dedicated space for members to share what they are doing, what they have learned, and where they need help. ASCA will continue to connect members with the evidence base - including the OECD's work, the NIAA Framework, and the practical models emerging from CSIRO, NAILSMA, and community-controlled organisations.

The question 'whose data is it?' is not rhetorical. It is the design brief for the next generation of smart community infrastructure. And it is a question that, if answered well, will produce better systems for everyone.

References

[1] OECD (March 2026). Indigenous data sovereignty: The future of evidence-based policy in Australia and New Zealand — event summary. Organisation for Economic Co-operation and Development — https://www.oecd.org/en/events/2026/03/indigenous-data-sovereignty-the-future-of-evidence-based-policy-in-australia-and-new-zealand.html

[2] IWGIA (2026). Indigenous Data Sovereignty — The Indigenous World 2026. International Work Group for Indigenous Affairs — https://iwgia.org/en/indigenous-data-sovereignty/6018-iw-2026-indigenous-data-sovereignty.html

[3] AIATSIS (2020). AIATSIS Code of Ethics for Aboriginal and Torres Strait Islander Research. Australian Institute of Aboriginal and Torres Strait Islander Studies — https://aiatsis.gov.au/publication/116530

[4] National Indigenous Australians Agency (2024). Framework for Governance of Indigenous Data. Australian Government / NIAA — https://www.niaa.gov.au/resource-centre/framework-governance-indigenous-data

[5] Department of Industry, Science and Resources (December 2025). National AI Plan. Australian Government — https://www.industry.gov.au/publications/national-ai-plan

[6] Prehn et al. (2025). Implementing Indigenous Data Sovereignty in Australia: A Five-Phase Framework for Indigenous Data Governance. Australian Journal of Social Issues (Wiley) — https://onlinelibrary.wiley.com/doi/10.1002/ajs4.70086

[7] CSIRO / NAILSMA (2022). A digital futures roadmap for Northern Australia's Indigenous land and sea managers. CSIRO — https://www.csiro.au/en/research/indigenous-science/indigenous-enterprise/digital-futures-roadmap

[8] Greater Sydney Commission (2018, updated). Greater Sydney Region Plan — A Metropolis of Three Cities. NSW Government — https://www.greater.sydney/sites/default/files/greater-sydney-region-plan.pdf

[9] AHURI (2023). Incorporating Indigenous knowledge and perspectives into the development of Australian cities. Australian Housing and Urban Research Institute — https://www.ahuri.edu.au/analysis/brief/incorporating-indigenous-knowledge-and-perspectives-development-australian-cities

[10] Lowitja Journal (2025). Recognising Indigenous data sovereignty and implementing Indigenous data governance at the Ngangk Yira Institute for Change. First Nations Health and Wellbeing — The Lowitja Journal — https://www.lowitjajournal.org.au/article/S2949-8406(25)00030-0/fulltext

The Australian Smart Communities Association acknowledges the Traditional Custodians of the lands across Australia on which our members live and work, and pays respect to Elders past, present and emerging.