Your community’s data belongs to your community. That principle sits at the heart of Indigenous data sovereignty, and it has practical implications that go far beyond policy documents and reconciliation frameworks. For band councils, administrators, and IT leads at First Nations organizations in BC, it shapes decisions you are already making about where your information lives, who controls it, and what protections are in place.

This post is written for the people making those decisions. It covers what Indigenous data sovereignty means in concrete terms, what the OCAP® principles require in practice, what Canadian data governance law says about your rights, and what good First Nations IT support in British Columbia looks like when data sovereignty is a genuine priority.

What Indigenous Data Sovereignty Means

Indigenous data sovereignty is the right of First Nations peoples to govern data that comes from their communities and pertains to their members, lands, languages, and knowledge. It is not a new concept, it reflects rights that have always existed, but the digital era has made it more urgent and more concrete.

The First Nations Information Governance Centre (FNIGC) defines Indigenous data broadly. It includes data from Indigenous people — cultures, languages, ceremonies, stories — as well as data about Indigenous people, covering demographics, health, housing, education, and employment. It also covers data on Indigenous lands and resources, including waters, medicines, and animals.

When your organization stores community health records in a system governed by a US company, or when your member data sits on servers outside Canadian jurisdiction, questions of sovereignty are not theoretical. They are immediate. Who can access that data? Under which country’s laws? Who decides how it is used?

These are the questions Indigenous data sovereignty asks you to answer and to answer on your own terms.

The OCAP® Principles and First Nations Data Governance in BC

The most established framework for Indigenous data governance in Canada is OCAP®, a registered trademark of the First Nations Information Governance Centre. OCAP® stands for Ownership, Control, Access, and Possession. Established in 1998, it provides a practical standard for how First Nations data should be collected, protected, used, and shared.

Each principle has meaning on its own:

Ownership holds that a community owns its information collectively, the same way an individual owns their personal information. The data does not belong to the researcher, the government, or the IT vendor. It belongs to the Nation.

Control means that First Nations and their governing bodies have authority over all aspects of data management — what gets collected, how it is stored, who analyses it, and how findings are shared. This control applies at every stage, not just at the point of collection.

Access affirms that First Nations must be able to access data about themselves and have meaningful involvement in decisions about who else can access it.

Possession addresses the physical and technical reality of where data lives. Even if a community asserts ownership, possession matters. If data sits on servers controlled by a third party, practical sovereignty is limited. Possession means that data should be held by the First Nation itself, or by a data steward chosen by the community that is committed to upholding the other three principles.

For First Nations organizations in BC evaluating cloud storage or IT infrastructure, the Possession principle is often where the conversation gets most practical. If your email, membership records, or health data are hosted on US-based infrastructure, possession — in the OCAP® sense — has already left the building.

What Canadian Law Says About Your Data

Indigenous data sovereignty is increasingly backed by law.

BC was the first province in Canada to legislate the United Nations Declaration on the Rights of Indigenous Peoples (UNDRIP) through the Declaration on the Rights of Indigenous Peoples Act (DRIPA) in 2019. The federal government followed with its own UNDRIP Act in 2021. Article 31 of UNDRIP affirms the rights of Indigenous peoples to maintain, control, protect, and develop their cultural heritage, traditional knowledge, and intellectual property.

What this means in practical terms is that the legal foundation for asserting data governance rights is stronger than it has ever been in BC. Organizations that are making IT decisions today — about cloud platforms, data hosting, vendor relationships — are making decisions within a legal and policy environment that increasingly supports Indigenous self-determination over community information.

The question is not whether your community has these rights. The question is whether your current IT infrastructure reflects them.

Where Your Data Lives: The Canadian Hosting Question

Most cloud platforms default to US-based servers. Microsoft 365, Google Workspace, and the majority of mainstream cloud services store data on American infrastructure. For many businesses, that is an acceptable arrangement. For First Nations organizations, it raises questions that go beyond convenience.

When data crosses the border into US jurisdiction, it falls under American law — including legislation that can give US authorities access to that data without the knowledge or consent of the data’s owners. Canadian privacy law applies to data stored in Canada. Once it leaves, that protection changes.

For a First Nations organization storing member health records, language archives, governance documents, or land-related data, the question of where that data physically lives is a data sovereignty question. It is also a question with a concrete answer, one that depends entirely on what infrastructure your organization uses and where that infrastructure is hosted.

Canadian-hosted cloud storage is not a niche option reserved for large institutions. It is available, and for organizations where data residency matters, it is the right choice.

At Intraworks, we offer two Canadian-hosted options depending on the size and needs of your organization. Smaller organizations typically work with Groupshare, our Canadian-hosted platform for file sharing, email, and collaboration, keeping your data on Canadian soil and governed by Canadian law. Larger organizations that need dedicated infrastructure and greater control work with us through our data centre in Nanaimo, where private cloud servers keep email, files, and applications hosted on Canadian soil with no shared infrastructure. To our knowledge, no other IT provider on Vancouver Island offers both options to First Nations clients.

If Canadian data hosting is a priority for your organization, it is a question to put directly to any IT provider you are evaluating.

What Good First Nations IT Support in British Columbia Looks Like

IT support for First Nations organizations in British Columbia is not the same as IT support for a general small business. The stakes are different. The data is different. The governance obligations are different.

When evaluating an IT partner, there are questions that go beyond response time and service lists:

• Does the provider understand OCAP® and what it means for how your data should be handled? 
• Can they speak clearly about where your data lives and under which country’s laws?
• Do they have experience working with Indigenous organizations, and can they speak specifically to what that experience looks like in practice? 
• Do they approach the relationship as a long-term partnership, or as a service contract?

The answers to those questions will tell you more than any proposal document.

We have worked with First Nations organizations on Vancouver Island and across BC for many years. When we recommend a platform, data residency is part of the conversation. When we set up cloud services, Canadian hosting is the default for clients where it matters.

If you want to speak to an organization we have worked with before reaching out to us, we are happy to make that introduction.

A Practical Starting Point

If you are an administrator, IT lead, or band council member thinking through your organization’s data governance, here is a useful place to start: ask your current IT provider where your data lives today.

Not where they think it lives. Where it lives. Which servers. Which country. Under which jurisdiction.

If they cannot answer that question clearly, it’s important to have a broader conversation about whether your current setup supports the data sovereignty principles your community is entitled to assert.

The First Nations Information Governance Centre offers resources and training on OCAP® that are worth exploring regardless of where your organization is in this process. Their Fundamentals of OCAP® course is designed for people working with First Nations data and provides a strong foundation for the governance conversations your organization may already be having.

Let’s Have the Conversation

Every First Nations organization’s situation is different. The right infrastructure for one community may not be right for another. What is consistent is the right to make that decision, and to make it with accurate information about where your data lives and what protections are in place.

If you want to talk through what data sovereignty looks like in practice for your specific organization, we are happy to have that conversation. There is no sales process attached to it. Reach out to us and we will give you a straight answer about what we can offer and where another provider might be a better fit.

Book Your Free Assessment  |  Or give us a call: 866-729-8624.