Data sovereignty
Every photo, sound or field record originates in a territory and in the work of the people who care for it. Data sovereignty ensures that those communities have authority over how their data is collected, stored, used and shared, and that they receive the benefits. It is a condition for replicating a project like Tech4Nature Mexico: with clear data agreements, the project gains trust and continuity.
The Sovereign Data Supply Chain
The guide we use is the Sovereign Data Supply Chain, a functional and operational framework by Kinray Hub, NaturaTech LAC and Climate Collective (version 1.0, February 2026, CC BY 4.0 license). Its goal is for communities to move from being passive data subjects to Source Domain Authorities, with real capacity to decide about their biocultural assets.
The framework builds on the CARE and FAIR principles, free, prior and informed consent, and instruments such as the United Nations Declaration on the Rights of Indigenous Peoples, ILO Convention 169, the Escazú Agreement and the Nagoya Protocol.
- Upstream: territorial authorities
- Indigenous peoples, local communities and their governing councils. They are the source of the data and the authority that decides about it.
- Midstream: intermediaries
- Those who hold, process or label data on behalf of a community: supporting organizations, universities and platforms such as BioScanner.
- Downstream: users
- Those who use the data to make decisions, conduct research or develop products: public agencies, conservation organizations, research centers and markets.
The five protocols
Establish the Source Domain Authority. Identify who legitimately speaks for the territory, distinguish between Indigenous peoples and local communities, and appoint in assembly the people who will act as a bridge, with a written mandate. It is the basis for everything else.
Agree on an FPIC-centered contract. Inventory the types of data and their sensitivity, define authorization levels and draft the agreement in at least two languages, with an ecological veto and the right to revoke access.
Ensure biocultural and technical integrity. Set how data is collected, verify its provenance and quality, and mark traditional knowledge with labels that state its conditions of use.
Register biocultural assets. Document the relationship between data, territory and authority, assign provenance identifiers and allow analysis of sensitive data without handing over the original data.
Activate reciprocity and revocability. Agree on how benefits are distributed, including training, co-authorship and recognition, how access is suspended and how conflicts are resolved, with primacy of community jurisdiction.
What we did in Dzilam
In Dzilam, access to equipment and jaguar locations is reserved for the state government, C Minds, community leaders and authorized partners, to protect the species and keep the community in control of information about its territory. BioScanner is being built so that each community and institution decides who sees its data, what is shared and with whom.
The experience also raised questions we are still discussing with the institutions and the community, and that are worth putting on the table at the start of any project.
Questions to put on the table
Many protected areas are publicly administered, while the communities are the ones who monitor, conserve and lead day to day. In those cases, these questions deserve an open conversation among the authority, the community and partners before the first piece of equipment is installed.
- Who is the source domain authority when the government manages the reserve and the community generates the data: the authority, the community or both, and under what rules?
- How do you balance transparency and access to public information with the protection of knowledge, trails and sensitive locations?
- Who authorizes new uses of the data, such as research, training AI models or financing mechanisms?
- Where is the data stored, and who is responsible for it when the government changes or a project ends?
- How are the people who generate the data recognized and compensated when it underpins public decisions, reports or new resources?
- Can the community revoke access or withdraw data, and through what procedure?
- Is this an Indigenous people, a local community or both, and which rights and consultation processes apply in each case?
Lesson learned
Data sovereignty is built through explicit agreements from the design stage. When the public authority and the community answer these questions together, monitoring gains legitimacy, continuity and the trust it needs to scale.
Tools to get started
- Sovereign Data Supply Chain, framework V1.0 (opens in a new tab) (Kinray Hub, NaturaTech LAC and Climate Collective, 2026). DOI 10.5281/zenodo.18675313.
- Principios CREA para la gobernanza de datos indígenas (opens in a new tab) (GIDA, Spanish version of the CARE Principles).
- Etiquetas de Conocimiento Tradicional (opens in a new tab) (Local Contexts, in Spanish), to state conditions of use for traditional knowledge in digital environments.
- Buenas prácticas para generalizar datos de especies sensibles (opens in a new tab) (GBIF, in Spanish).
- Template 2 of this toolkit: data agreement. P2
The framework in practice
Since April 2026, Fundación Pachamama and the Achuar community of Sharamentsa have been piloting the framework within the Jaguar Biocultural Strategy. Under Protocol 1, the community assembly grants mandates and delegates to community members the authority to decide about the data.
Other pilots apply it in different contexts, such as Seaflower WISE with the Raizal community of the Colombian Caribbean, on artisanal fishing data and marine mapping. Lessons from the pilots feed into the next version of the framework.
Read the framework on ECOS (NaturaTech LAC) (opens in a new tab)