Data Sharing & Indigenous Data Sovereignty Policy

1 · Purpose

This policy governs how Nxt7a shares data generally, and – central to our mission – how we respect Indigenous Data Sovereignty: the right of Indigenous peoples to govern the collection, ownership, access and use of data about their communities, lands, knowledge and resources. It is a foundational policy, not an add-on.

2 · Scope

Applies to all data Nxt7a collects, holds, derives, shares or enables others to share, and applies with particular force to any data relating to Indigenous peoples, their Country, and their traditional knowledge – whether held on the platform, in BigQuery, or anywhere else.

3 · Policy Statements

General Data Sharing

Lawful, purposeful, controlled. Data is shared only for legitimate purposes, with the rights to do so, under appropriate agreements, and with security and access controls per the Information Security, Access Control and Data Classification policies. Client and partner data is isolated and not shared across parties without authority.

Indigenous Data Sovereignty

Guiding frameworks. Our approach is guided by:

• the CARE Principles for Indigenous Data Governance – Collective benefit, Authority to control, Responsibility, and Ethics;
• Indigenous Data Sovereignty principles as articulated by Indigenous data networks (including the Maiam nayri Wingara principles in Australia);
• the UN Declaration on the Rights of Indigenous Peoples (UNDRIP), including Free, Prior and Informed Consent (FPIC).

Authority to control. Indigenous communities hold authority over data and knowledge concerning them. Nxt7a acts as a steward and enabler, not an owner, of such data. Decisions about access and use rest with the relevant community or its governance body.

Free, Prior and Informed Consent. We obtain FPIC before collecting, using or sharing Indigenous data or traditional knowledge, on terms the community understands and agrees to, and we respect the right to withdraw or vary consent.

Traditional Knowledge Labels. Where communities apply Traditional Knowledge (TK) Labels (e.g. via Local Contexts), Nxt7a honours the permissions, restrictions and protocols those labels express, carrying them through our systems and any onward sharing.

Collective benefit and equity. Consistent with our purpose, we work so that communities share equitably in the value created from their data and stewardship – benefit-sharing is a design principle, reflected in our commercial and licensing arrangements.

Responsibility and care. Indigenous data is treated as sensitive by default (Confidential or Restricted), with heightened security, restricted access, and care in how it is represented. It is not input into AI tools except as expressly permitted (see AI Use Guidelines).

Governance. Nxt7a maintains, and over time strengthens, Indigenous governance and advice in decisions affecting Indigenous data, moving toward Indigenous participation in governance.

4 · Roles & Responsibilities

• CEO / Indigenous Data Governance Lead owns this policy and FPIC and benefit-sharing decisions.
• All personnel identify Indigenous data, apply its protections, and escalate rather than assume.
• Partners and suppliers meet equivalent obligations (see Supplier Code of Conduct).

5 · Compliance, Monitoring & Breach

Breaching consent, TK Label permissions, or the protections for Indigenous data is among the most serious breaches at Nxt7a, given our mission and relationships, and is handled accordingly – including notification to affected communities.

6 · Related Documents

Code of Conduct · Information Security Policy · Access Control Policy · Data Classification & Retention Policy · Privacy Policy · Responsible AI Policy · Model & Data Governance Policy · AI Use Guidelines · Supplier Code of Conduct.

7 · Standards Mapping

• B Corp: Community, Customers.
• ISO/IEC 27001:2022: A.5.12 (classification – Indigenous data as sensitive).
• ISO/IEC 42001:2023: A.7 (data for AI systems).
• Reference: CARE Principles; UNDRIP / FPIC; Indigenous Data Sovereignty principles (incl. Maiam nayri Wingara); Local Contexts TK Labels.

Review note. This policy should be developed with Indigenous partners, not only reviewed by counsel. Validate FPIC and benefit-sharing wording against actual community agreements and the platform's licensing framework with [COO or delegate].

8 · Version History