Skip to main content

Rangatiratanga and Māori data

Māori Data Sovereignty concerns Māori authority and relationships in relation to Māori data. In GIS, that reaches much further than ownership of a file or the location of a server. Spatial knowledge may sit within whakapapa, whenua, wai, mātauranga, whanaungatanga and collective responsibilities that do not fit neatly inside Western ideas of personal information or intellectual property.

Rangatiratanga therefore includes the practical ability to make and uphold decisions about collection, representation, access, analysis, publication, reuse, derived information, preservation and disposal. It also includes the ability to decide that some knowledge should not be collected, mapped or digitised at all.

Te Mana Raraunga describes Māori data as a living taonga of strategic value and advocates for Māori rights and interests across the data lifecycle. The Māori Data Governance Model, developed by Māori data experts, provides a related operational framework for organisations and the public service.

Māori data is broader than personal data​

Māori data can include information about or connected with:

  • Māori people and whānau
  • iwi and hapū
  • whakapapa
  • whenua and wai
  • taonga species
  • mātauranga
  • Māori language
  • cultural sites and landscapes
  • environmental observations
  • customary activity
  • Māori organisations and communities

Some of this may be personal information under the Privacy Act. Much of it may not be. A layer showing an urupā, mahinga kai, rohe-related information or taonga species can carry significant collective interests and responsibilities without containing a person's name.

That is why ordinary privacy compliance cannot be used as a complete Māori data-governance test.

For this guide:

Data sovereignty concerns the authority, relationships and responsibilities under which Māori data is created, held, interpreted, used and governed.

Data governance concerns the roles, processes, structures and rules used to give practical effect to that authority and those responsibilities.

A project can say that Māori retain sovereignty while still having weak governance. For example, an agreement may say a hapū owns its data while the consultant remains the only administrator, controls the cloud tenant and has never tested a full export. The written claim and practical capability are then different things.

The reverse can also happen: a technically disciplined system may still be weak from a Māori perspective if it has excellent permissions and backups but poor relationships, unclear mandate, little whānau benefit or no meaningful Māori voice in decisions about reuse.

Rangatiratanga is not simply ownership​

Western information systems often ask a narrow question: who owns the intellectual property?

That matters, but it may not describe the full relationship between Māori and data connected with whakapapa, whenua, taonga and collective knowledge.

A contract can assign ownership and still leave unresolved questions such as:

  • who has authority to approve collection
  • what whakapapa, tikanga or collective mandate sits behind that authority
  • who decides what may be represented on a map
  • who decides which audience can see exact locations
  • whether information may be combined with another dataset
  • whether a government agency may reuse it for another purpose
  • whether a provider may use it to improve an AI system
  • who may authorise deletion
  • whether the knowledge should ever have been digitised
  • what obligations continue after the original project has ended

Do not translate rangatiratanga mechanically into data owner and assume the work is finished.

Practical authority matters​

A useful test is whether the Māori organisation can actually exercise the decisions it says it holds.

Can it:

  • create and remove users?
  • change permissions?
  • see logs where needed?
  • obtain a complete copy of the data and its context?
  • recover attachments and metadata?
  • restore a backup?
  • revoke a consultant's access?
  • leave the platform?
  • retain an independent archive?
  • continue operating when a staff member leaves?
  • explain to future kaitiaki why the data exists and what conditions travel with it?

If the answer is no, there may be a gap between formal authority and practical control.

Canada's First Nations OCAP framework gives particular emphasis to possession, which is useful comparatively because it draws attention to this practical dimension. OCAP is not a Māori framework and should not be imported uncritically, but the distinction is valuable for GIS procurement.

Authority can include the decision not to collect​

Data programmes often assume more information is better. A Māori-centred approach can include a different decision: the information does not need to become a digital record.

Examples may include kōrero where:

  • digitisation would separate knowledge from the relationships that give it meaning
  • exact location creates unnecessary risk
  • the project's purpose can be met with a generalised area
  • the appropriate knowledge holders have not authorised recording
  • the information is not needed to achieve the stated outcome
  • a non-digital or relationship-based way of holding the knowledge is more appropriate

A decision not to map something can itself be an exercise of rangatiratanga and kaitiakitanga.

Sovereignty does not mean never sharing​

Strong authority may support deliberate sharing where it creates collective benefit and maintains the right relationships.

Examples include:

  • publishing approved traditional place names
  • sharing environmental observations for restoration and kaitiakitanga
  • providing a council with a purpose-limited cultural layer for a planning process
  • supplying a generalised dataset for emergency management
  • giving whānau wider access to an approved digital archive

The question is not whether data leaves the organisation. It is whether sharing is authorised, purposeful, understood, beneficial and governable, and whether the conditions attached to the information travel with it.

The CARE Principles are useful here because they place Collective Benefit alongside Authority to Control, Responsibility and Ethics.

GIS consequences​

Rangatiratanga has direct technical consequences. Depending on the kaupapa, it can affect:

  • tenant and account ownership
  • administrator roles
  • database permissions
  • API access
  • field-app offline areas
  • publication workflows
  • metadata exposure
  • data-sharing agreements
  • backup locations
  • export formats
  • retention periods
  • AI settings
  • vendor contracts
  • archival arrangements

These controls are not the kaupapa themselves. They are the mechanisms through which decisions grounded in whakapapa, tikanga, authority and responsibility can be carried into a digital environment.

Sources​

Last reviewed: 16 August 2026

Last updated on