Framework for Governance of Indigenous Data
Australia · Framework · National Indigenous Australians Agency
Our summary
A framework designed to guide Australian Public Service agencies in managing Indigenous data with Aboriginal and Torres Strait Islander peoples having genuine involvement in decision-making. Developed through co-design with First Nations partners, it establishes four guiding principles for implementing data governance across the government sector. Implementation is expected to commence in January 2025 with agencies developing seven-year implementation plans.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
2 sections
Jump to a chapter
Framework overview
Establishes a unified framework for Australian Public Service agencies to work with Indigenous data, centered on giving Aboriginal and Torres Strait Islander peoples genuine involvement in decisions affecting them, including how data informs government policy. Developed through co-design with Indigenous partners, the framework promotes Indigenous data sovereignty and increases First Nations agency over government-held Indigenous information throughout the data lifecycle.
Implementation framework and principles
Australian Government agencies must create a multi-year plan for adopting the Framework, structured around four key principles: partnering with Aboriginal and Torres Strait Islander communities, strengthening data management competencies, documenting data holdings, and establishing an equitable data infrastructure. Implementation commences in January 2025 with support from the National Indigenous Australians Agency.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 4 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 1 of 4
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 1 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 7 are shown.
Framework overview 2 controls
- ObligationApplies to: Public authorityDrafted by the Index
Government should involve Aboriginal and Torres Strait Islander peoples in meaningful decisions about how Indigenous data informs policy.
- ObligationApplies to: Public authorityDrafted by the Index
Government should support Indigenous data sovereignty and increase First Nations agency over government-held Indigenous information.
Implementation framework and principles 5 controls
- ObligationApplies to: Public authorityDrafted by the Index
Australian Government agencies should develop a multi-year implementation plan for adopting the Framework.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies should partner with Aboriginal and Torres Strait Islander communities as part of implementing the Framework.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies should strengthen their data management competencies and skills when implementing the Framework.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies should document their data holdings as part of implementing the Framework.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies should establish an equitable data infrastructure to support Indigenous data governance.
Change history
No changes recorded since we began monitoring this policy.