Māori Research Data Governance in New Zealand Universities

Abstract

Universities in Aotearoa generate and hold large volumes of research data, including increasing amounts of Māori data shaped by Vision Mātauranga. Yet practice around Māori Data Sovereignty (MDSov) remains uneven, with commitments often aspirational rather than operational. This article assesses how Tiriti‐led institutions are upholding the mana and mauri of Māori data as taonga and identifies how bureaucratic inertia maintains the gap between policy signals and everyday research practice. Using a data ecosystem lens, we consider the roles of actors, stakeholders and Māori as rightsholders across the research lifecycle. A case study of Waipapa Taumata Rau highlights both progress and fragmentation. We synthesise recent Māori and Indigenous data governance developments and propose practical steps to shift from voluntary alignment to accountable practice. We argue that meaningful implementation of Māori Research Data Governance is necessary for universities to act as kaitiaki and ensure Māori benefit from data use and reuse.

List of Acronyms Used

IDSov

Indigenous Data Sovereignty

MDSov

Māori Data Sovereignty

TMR

Te Mana Raruanga

TKR

Te Kāhui Raraunga

IDGov

Indigenous Data Governance

ASU

Arizona State University

VM

Vision Mātauranga

FAIR

Findable, Accessible Interoperable, Reusable

GIDA

Global Indigenous Data Alliance

CARE

Collective Benefit, Authority to Control, Responsibility and Ethics

RDM

Research Data Management

RDM DCMM

Research Data Management Data Capability Maturity Model

IIRC22

International Indigenous Research Conference 2022

1. Introduction: Contextualising Indigenous and Māori Data Sovereignty

Indigenous Data Sovereignty (IDSov) refers to the inherent rights and responsibilities of Indigenous peoples, communities and Nations to control data that derive from them, and which pertain to their communities, knowledge systems, lands and natural resources, including waterways (Kukutai and Taylor 2016; Lovett et al. 2019; Rainie et al. 2019; Russo Carroll et al. 2024). Central to IDSov is the assertion that Indigenous nations or collectives have the right to govern all aspects of the data eco‐system from the collection, analysis, interpretation, and management, through to dissemination, re‐use and possession of data (Walter, Lovett, et al. 2021; Walter, Kukutai, et al. 2021). IDSov has been described as a social movement (Russo Carroll et al. 2024), emerging in response to ‘…poor data practices, from the conceptualisation of data items through to reporting of data about Indigenous peoples’ (Lovett et al. 2019, p.26). This includes misrepresentation, extractive data use, and the marginalisation of Indigenous perspectives in data governance.

The publication Indigenous Data Sovereignty: Toward an Agenda in 2016 marked the formal establishment of IDSov as a field of inquiry. Despite its relative newness as a field and movement, IDSov is ‘…fed by many wellsprings’, building on the work of Indigenous scholars and allies across the fields of ‘…indigenous research ethics, cultural and intellectual property rights, nation‐building, and indigenous governance, within a frame of tribal sovereignty and self‐determination’ (Hudson et al. 2017, p. 65). Building on this foundational work, in 2023, the Global Indigenous Data Alliance (GIDA) identified 12 Indigenous Rights to data (Table 1). These Indigenous data rights are organised and described in two parts. The first, Data for Governance, refers to those rights which support and enable Indigenous communities to access and use data for themselves. In the second set of rights, Governance of Data, is that right which supports ‘...Indigenous communities to internally steward and externally influence the use of data’ (Hudson et al. 2023).

TABLE 1.

Indigenous peoples’ rights in data.

Data for Governance
Right to self‐determination	The ability to organise and control data in relation to a collective identity
Right to Reclaim	The right to reclaim, retain, and preserve data, data labels, and data outputs that reflect Indigenous Peoples’ identities, cultures and relationships
Right to possess	The ability to exercise jurisdictional control over the ways that data flow/ move/ are queried
Right to use	The ability of individuals and collectives to use data for their own purposes
Right to consent	The expression of digital autonomy and the ability to assess risks and accept potential harms
Right to refuse	The right to say ‘no’ to certain uses of data
Governance of data
Right to govern	The right to lead and collaborate in the development and implementation of protocols and decisions about access to data
Right to define	The right to define lifeways of knowing and being including how they are represented in data
Right to privacy	The protection of collective identities and interests from undue attention, also including the possibility of requesting omission and/or erasure
Right to know	The ability to track the storage, use and reuse of the data and who has had access to them
Right to association	The recognition of provenance and terms of attribution
Right to benefit	The opportunity to benefit from the use of data and equitable benefit sharing from derivatives of data

Source: Hudson et al. 2023.

These rights form the foundation for understanding the types of protections and capabilities needed to build transformative Indigenous data ecosystems.

Māori data sovereignty (MDSov) builds on IDSov and adds granularity for specific applications in Aotearoa. Grounded in Māori tikanga, world views, and aspirations, MDSov reflects the unique cultural and legal landscape in Aotearoa, shaped by Te Tiriti o Waitangi and recognises that the data rights of whānau, hapū, and iwi are central to tino rangatiratanga. Over the past decade, the MDSov movement has influenced the data ecosystem in Aotearoa, with advocacy and leadership driven primarily by Te Mana Raraunga (TMR) and Te Kāhui Raraunga (TKR) (Sporle et al. 2021). Both TMR and TKR continue to play central roles in asserting Māori data rights across policy, research and the public sector.

A cornerstone of the advocacy work of TMR has been the development and promotion of the Principles of MDSov, which guide the ethical collection, storage, and use of Māori data.

Rangatiratanga ‐ (Control ‐ Jurisdiction ‐ Self‐determination)

Whakapapa ‐ (Context ‐ Data disaggregation ‐ Future use)

Whanaungatanga ‐ (Balancing rights ‐ Accountabilities)

Kotahitanga ‐ (Benefit ‐ Build Capacity ‐ Connect)

Manaakitanga ‐ (Respect ‐ Consent)

Kaitiakitanga ‐ (Guardianship ‐ Ethics) (Te Mana Raraunga 2018)

These principles are enduring and have had far‐reaching influence in Aotearoa's research landscape. Growing institutional awareness is evidenced by the adoption of Te Mana Raraunga's MDSov principles by the Royal Society Te Apārangi (2023) as well as in international guidelines like the World Economic Forum's Data Equity Framework (2025), which positions the TMR MDSov principles alongside the CARE principles (Carroll et al. 2020), as critical pillars of ethical and equitable global data governance (World Economic Forum 2025). Over the past decade, there has also been an enthusiastic uptake of MDSov within universities, often being described as part of the commitment to upholding Te Tiriti o Waitangi. Seven of the eight universities in Aotearoa now identify MDSov as a key consideration for research with Māori, either to supplement their existing ethics processes or as part of Research Data Management.

While these references signal a positive shift, a significant gap remains between policy and practice. Institutional commitments to MDSov are often framed as aspirational rather than binding, with limited evidence of structural or enforceable accountability. At its core, MDSov requires that Māori determine ‘...the means of collection, access, analysis, interpretation, management, dissemination and reuse of data from or pertaining to them’ (Kukutai and Cormack 2020. p.22). Meeting that standard challenges well‐established research norms embedded in university processes. This was expressed in 2022 with the publication of the IIRC22 Communique (IIRC22 IDSov Collab 2022), which asserted that:

Universities are largely failing to protect and uphold IDSov. In many instances, universities are gatekeeping Indigenous data in ways that make it difficult for Indigenous peoples to identify, access, use, and benefit from it. Some want to be IDSov institutions, but their actions suggest the opposite. At worst, universities are enabling researchers to continue data practices that are extractive and exploitative. These practices not only contribute to systemic inequities but also result in data harms to Indigenous communities. This has to change.

The GIDA affirmed the above and flagged the lack of IDGov over Indigenous research data as a priority, arguing that:

Universities are failing to affirm and uphold Indigenous Data Governance, leaving these academic institutions open to claims of complicity in the ongoing structure of colonisation (Prehn et al. 2023).

Here, GIDA points to an important dimension of IDSov which is related to governance. Indigenous Data Governance (IDGov) is concerned with the processes, practices and standards that give effect to IDSov (Kukutai, Campbell‐Kamariera, et al. 2023). The role of universities is one of data governance. As colonial institutions, they cannot legitimately claim the authority to determine Indigenous data rights. While tertiary institutions should primarily operate within the realm of governance, universities in Aotearoa have integrated the language of MDSov into their guidelines. Therefore, this article addresses both concepts as they intersect with the university context.

This article looks at how the responsibilities researchers and universities have been given (to respect Indigenous data rights) are being enacted, or not, through policies or embedded into institutional research spaces. In doing so, we consider how a lack of adequate resources or support might be positioned within a ‘complex of failure’, or fracasomania (Walter, Carroll, et al. 2021). As Walter and Carroll note, Fracasomania refers to the tendency of bureaucracies to adjust to policy failure rather than address it. Responsibility for failure is distanced from policymakers, and repeated failure is met with no consequence (Walter, Carroll, et al. 2021).

We acknowledge that in environments shaped by Western research traditions, MDSov risks being treated as an optional add‐on. We use the ecosystem metaphor to make visible the relational work needed across the research lifecycle, and to examine whether current institutional arrangements enable benefit or contribute to the ‘complex of failure’ described by Walter, Carroll, et al. (2021), when policy change is not matched by capability, resources or accountability.

2. Universities as Sites of Colonialism

Researchers and universities have fraught histories of extracting, exploiting and misusing Indigenous data (Marley 2020; Smith 2021). Universities are well‐resourced powerhouses of knowledge generation and data production. They are also colonial institutions whose data practices have reproduced hierarchies about whose knowledge counts. The (re)presentation of Indigenous Peoples and knowledges as inferior sits neatly within colonialism and continues to persist in Westernised imperial research and ‘science’ (Paine et al. 2021) to the extent that ‘research’ has accumulated its status as a ‘dirty word’ (Smith 2021). This legacy of colonialism remains today in ways that shape how data is collected, classified, interpreted and circulated, as well as in whose interests those practices serve.

While modern institutional guidelines, like ethics, mandate specific oversight for research with Indigenous Peoples, this has not always translated into genuine accountability. Despite longstanding and robust frameworks intended to guide ethical practice for Indigenous data and research (Hudson et al. 2010), universities and researchers continue to fail Indigenous Peoples by producing work that misappropriates data and inflicts community harm. The Arizona State University (ASU) Havasupai Blood Case is an oft‐referenced international example of this disconnect. Beginning in 1990, blood samples collected for the use of diabetes and genetic testing breached Indigenous data rights when the university researchers misappropriated the blood samples for alternative, non‐consented testing. From this, they published separate studies on schizophrenia, inbreeding, evolution and migration unbeknownst to the Havasupai people (Harmon 2010). This case was legally settled in 2010 (Marley 2020); however, the researchers involved in the case maintain that they were practising ‘good science’ (Snipp 2016, p.49). The case of ASU misusing the Havasupai Peoples’ biological samples stands out as a clear, egregious example of unethical, extractive research conducted on or about Indigenous Peoples, but it is not unique.

While egregious examples of data misuse may be less visible or less frequently exposed in Aotearoa, the complex of failure persists through the active reproduction of deficit‐based data. This is driven by what Walter (2018) identifies as BADDR data – data that is Blaming, Aggregate, Decontextualised, Deficit and Restricted. BADDR data practices work to construct the ‘statistical Indigene’ who is defined through the ‘5d’ lens of disparity, deprivation, disadvantage, dysfunction and difference (Walter 2016). For Māori, the cumulative effect is research experienced as extraction. A cycle in which data is taken, disparities are documented, and the conditions that produced them remain intact. When researchers engage with carceral statistics, for example, they are often working with data that has already decontextualised Māori over‐representation from its colonial drivers (Stanley and Mihaere 2019). Because the data itself is BADDR, the resulting analysis inevitably fixes its lens on the ‘problematic Indigenous subject’ rather than the system (Bargallie et al. 2020). In this context, Indigenous policy problems are cast as unsolvable because Indigenous Peoples are presumed too problematic. The continued reliance on these deficit datasets is at best a tendency towards bureaucratic inertia (Kukutai and Walter 2015, p.318), and at worst colonial power being actively reproduced through institutional routine.

The idea of being researched to death is a lived reality for Māori (Macfarlane et al. 2020). Māori possess the mātauranga to rectify colonial machinations but are stymied by an academy that prefers the safety of the ’complex of failure’. As Macfarlane et al. (2020) observe, despite endless recommendations, mainstream systems continue to ‘marginalise and devalue’ Māori cultural traditions, language, and ways of knowing. Viewed within the logic of fracasomania, these recommendations simply become part of a larger paper trail that places real change in the ‘too hard basket’, a hallmark of a bureaucracy that has adjusted to, rather than addressed, its own shortcomings. While fracasomania presents a bleak view of bureaucratic inertia, Vision Mātauranga represents a significant, yet complex, policy attempt to disrupt this cycle within the Aotearoa New Zealand research landscape.

3. Vision Mātauranga and MDSov in the Universities Research Climate

Across Aotearoa, there has been sustained growth in scholarship about Māori by both Māori and non‐Māori researchers, which is attributable in part to Vision Mātauranga. Over the past two decades, Vision Mātauranga (VM) (Rauika Māngai 2020) has spurred a significant increase in Māori‐led and Māori‐focused research and established a baseline standard for ethical cultural engagement for researchers in Aotearoa New Zealand. Since its establishment in 2003, VM has become the primary mechanism for establishing research relationships between Māori and non‐Māori researchers for the co‐production of knowledge (Muru‐Lanning 2020). VM seeks to empower Māori knowledge, people, resources, and the future of Māori research (Rauika Māngai 2020). These aspirations have been taken up by the research landscape of Aotearoa and enacted through various spaces from applications for research funding, through to ethics applications to conduct research in Aotearoa.

Bureaucratic inertia is insidious in that it can coexist with genuine goodwill. An institution can want to change while its systems quietly ensure that nothing does. While the aspirations laid out in VM are bold and unapologetic, it still operates within the same ‘fracasomanic’ institutional research climate described above, and the lack of appropriate resourcing suggests that the complex of failure remains a persistent barrier. For example, the expansion of Māori research has increased the scale and diversity of Māori data held within universities, this greater volume has not, however, produced consistent oversight or practices that uphold Māori data rights. A recent critique from Māori researchers published by Ngā Pae o te Māramatanga (Kukutai et al. 2021) alludes to this disconnect, highlighting the absence of evaluative work to assess whether VM is achieving its intended outcomes. As Kukutai et al. (2021) state:

‘Neither Māori nor funders are currently able to identify how, where or to whom investment in Māori research is allocated, nor what transformational impacts are being derived. This lack of understanding makes it impossible to evaluate processes, or to understand what works well and where potential for improvement lies’ (Kukutai, et al. 2021, p.34).

The critique points to broader concerns about poor and inconsistent metadata practices, which hinder the ability to know what the size and scope of Māori data held by universities is (Sterling et al. 2023). If we don’t know what Māori data there is, how are we able to measure the impact? Without appropriate Māori data governance, more data could simply reproduce older extractive patterns, rather than shift them. MDSov, then, is closely connected to the aspirations of VM as both are designed to challenge research norms and unlock the innovative potential of culturally aligned research practices (Sporle et al. 2021).

4. The Ecosystem Lens

This next section takes up the challenge laid out in Principle 4.1 of the MDSov principles that: ‘Data ecosystems shall be designed and function in ways that enable Māori to derive individual and collective benefit.’ (Te Mana Raraunga 2018). The principle is clear, yet specific guidance on what a Māori data ecosystem looks like in day‐to‐day university research is thin (West 2025). The metaphor of an ecosystem is drawn from nature and has become a popular way to conceptualise the complex relationships and behaviours at the intersection of social and technical systems (Howard and Hyland‐Wood 2024). A data ecosystem describes ‘a network of actors that create, manage, exchange, and use data as a core resource’ (Oliveira and Lóscio 2018, p. 1). These ecosystems emerge and evolve in response to changes in political, technological, and social environments (Howard and Hyland‐Wood 2024), making them useful for conceptualising both the messiness and the potential of contemporary data governance.

In their description, Howard and Hyland‐Wood (2024) propose two core elements of a data ecosystem:

‘First, ecosystems can emerge and adapt spontaneously, without external initiation or overarching management. Instead, they operate via mutual adjustment between constituent elements. Second, ecosystems display heightened or radical interdependencies between their components, to the extent that the actions of each member influence all others, not simply those in direct interaction or close proximity’ (p.112−113).

The focus on relationality and radical interdependencies moves us away from seeing data governance as a top‐down, linear or unidirectional decision‐making process. Instead, we can consider the potential for actions, large and small, to have a cumulative or compounding effect in transforming our data ecosystems. In doing so, there are greater opportunities to think about what a decentred approach to the development of data policy and access to decision‐making might look like (Medyckyj‐Scott et al. 2016). This framing also supports an imagining of Māori data ecosystems to be inclusive of the social systems in which decisions about who collects, defines, interprets and benefits from data are made.

In data ecosystems, organisations, institutions and in some cases, individuals can be classified as ‘actors’. These actors are responsible for establishing mechanisms like governance frameworks and standards, which can determine how data flows and who benefits. Stakeholders are those who are affected by these decisions. In a university environment, we might think of senior leadership, governance groups and working groups as ‘actors’ while research‐active academics, research support teams and committees (e.g. ethics committees) might be seen as ‘stakeholders’. The relationship between actors and stakeholders is not clear‐cut or unidirectional though, as stakeholders maintain the power to provide feedback and affect change through things like consultation processes. Applying this framework to research data governance means we also need to consider the roles of Indigenous Peoples as ‘rightsholders’ within the ecosystem, acknowledging that there are distinctive legal and moral rights that Indigenous Peoples have when it comes to data (Russo‐Carroll et al. 2024).

5. Mechanisms, Processes and Tools

Mechanisms provide high‐level governance for the maintenance of networks and relationships within the research data ecosystem. They establish who holds authority, what minimum standards apply, and what happens when standards are not met. In Aotearoa's research landscape, these mechanisms span formal legal obligations, research funding requirements, and university strategy and governance. Mechanisms do not themselves guarantee ethical practice. They do, however, create the conditions in which processes and tools can be designed and implemented in ways that uphold Māori data rights.

Processes give practical effect to the mechanisms; they add granularity and specificity, which enable the mechanisms to be meaningful in context. Included under the broader umbrella of processes are guidelines, frameworks, and institution or organisation‐specific policies or ‘best practice’ models. For example, procedures for ethics, data collection and research data management. While many of these processes do not confer direct control or ownership, they help shift the culture of data work by embedding Māori worldviews, tikanga, and values into institutional and community‐based data practices. In doing so, they enable incremental but powerful shifts towards more relational, ethical, and culturally grounded engagements with Māori data.

Finally, in a data ecosystem, tools are the enablers of data practice. They facilitate the production, storage, analysis, sharing, and reuse of data. These tools range from hardware and software infrastructure, such as data storage platforms and visualisation systems, to metadata standards, digital tagging protocols, and platforms for data access. Tools often operate at the applied end of the data governance continuum. While mechanisms define high‐level principles and processes shape practice, tools provide the means through which these values are enacted in real time.

6. Case Study: Waipapa Taumata Rau

Waipapa Taumata Rau provides a compelling case study of both the potential and the challenges of embedding MDSov within a university context. In 2021, Waipapa Taumata Rau commissioned a review of its Research Data Management Infrastructure, resulting in the Waipapa Taumata Rau Research Data Management (RDM) Stocktake Report (RDM Project Team 2021) and accompanying MDSov Report (Allport 2021). These internal reports responded, in part, to the University of Auckland's stated aspiration to ‘...forge enduring partnerships and guide our progress towards becoming a Māori Data Sovereignty organisation’ (University of Auckland 2021).

As part of the RDM Stocktake, the Research Data Management Data Capability Maturity Model (RDM DCMM) was developed. This model was designed to describe the ‘collection of core, and enabling capabilities required to deliver research and learning and teaching activities’ (RDM Project Team, 2021, p.17) and established a critical baseline assessment of institutional readiness and capability in RDM. Included in the DCMM was a MDSov dimension which drew directly from TMR's MDSov Principles.

When assessed, Waipapa Taumata Rau received a perhaps unsurprising yet still concerning assessment of Level 1– initial (Table 2), the lowest rating on the DCMM (Allport 2021; Armstrong et al. 2021).

TABLE 2.

Level 1 of the Māori data sovereignty dimension in the DCMM.

Maturity Level

Maturity Level Descriptors

Initial: Process disorganised and ad hoc

1.1 Little or no recognition of Māori data 1.2 Māori data is stored overseas and there is a poor regulatory environment 1.3 Some consideration of risks for Māori but no specific access arrangements 2.1 No data on whakapapa ‐ ethnicity data and iwi affiliation 2.3 No consideration of future use 3. Little understanding of sensitivities in use of Māori data or accountability to iwi and individuals 4.1 No consideration given to Māori in the design and function of data ecosystems 4.2 No Māori research workforce capacity building to enable the creation, collection, management, security, governance and application of data 5.1 Little awareness or understanding of the potential harm and loss of dignity to Māori through some use and interpretation of Māori data 6.1 Māori data stored without consideration of the implications of location/security 6.2 Ethics: some consideration of risks for Māori but no consent processes for Māori data

Source: Armstrong et al. 2021.

This foundational‐level rating reflected a general lack of knowledge, guidance, and support for MDSov across the institution, highlighting significant gaps between aspirational statements and operational reality (Allport 2021). The assessment revealed that while the University had articulated its commitment to becoming a MDSov organisation, the necessary infrastructure, processes, and cultural competency were largely absent. The ultimate goal of having a maturity model is to be able to visualise an actionable pathway from ‘initial’ to ‘optimised’ (Table 3). Through the DCMM, Waipapa Taumata Rau presented an idea of what being a ‘Māori data sovereignty’ lead institution.

TABLE 3.

Level 5 of the Māori data sovereignty dimension in the DCMM.

Maturity Level

Maturity Level Descriptors

Optimised: Focus is on continuous improvement

1.1a Māori Data sovereignty and CARE principles are intrinsic to RDM at an institutional level 1.1b Māori rights to data and interests in data are recognised ‐ exclusive rights /shared rights /shared interests 2.1 Māori metadata (including origin, consent and availability) is machine‐readable and available for federation with other registries 3.2a Cultural licence: Māori/iwi have confidence in the ability of the organisation to use and share data in a legitimate and culturally acceptable way 3.2b Operational practices, standards and exemplars are available to all, to meet Māori data sovereignty and CARE obligations 4.1 Māori data aligns with FAIR principles, enabling collective benefit. 4.2 Māori and other indigenous peoples have the capacity to fully manage data to meet aspirations and enable common goals (CARE) 5.1 Collection, use and interpretation of data uphold the dignity of Māori communities, groups and individuals 6.1 Māori data are protected against future harm 6.2 RDM is aligned with the principles of whanaungatanga, rangatiratanga, kotahitanga, whakapapa, manaakitanga and kaitiakitanga 6.3 Māori/iwi involved in decision‐making for issues that have been escalated

Source: Armstrong et al. 2023.

The RDM stocktake report identified two recommendations to enable the University to move toward its bold aspiration:

• 2.AImplement and appropriately resource a governance structure to provide institutional oversight of policies, principles and practices relating to Māori Data and monitor progress of specific improvement initiatives and overall institutional maturity in MDSov.
• 2.BEstablish University‐wide MDSov role (akin to Privacy Officer) to operationalise the decisions of the governance structure, develop operational guidelines and procedures, support identification of issues and risks for escalation, and deliver education, training, and support for staff and students.

Allport (2021) expanded on these recommendations to suggest five steps that can be seen as a ‘roadmap’ to implementation:

• 1.Development of University‐specific MDSov principles;
• 2.Implementation of a robust Māori data governance structure;
• 3.Creating practical implementation guidelines and tools, including clear expectations for researcher conduct and practice assessment mechanisms;
• 4.Establishing comprehensive education, training, and support programmes for all research staff and students;
• 5.Developing cyclical frameworks and tools for ongoing reflection, review, and continuous improvement of MDSov practices (p.5).

Shortly after these reports were finalised, the Pou Tiaki Raraunga role (now Pou Tiaki Rangahau) was established to respond to recommendation 2.B. The person in this role is positioned as both an actor and a stakeholder within the research ecosystem. To be effective, the Pou Tiaki Rangahau must have communication networks with other relevant actors and stakeholders, as well as support from additional groups to carry out activities. These could be research‐specific groups like the Māori Research Governance Group, as well as wider networks like the University of Auckland Rūnanga. Beyond the establishment of the Pou Tiaki Rangahau role, though, progress on the recommendations from the RDM Stocktake Report, or the specific MDSov Report, appears limited and fragmented. A cursory search for MDSov on the Research Hub, the University's primary research policy interface, has 14 results. The first being a webpage of MDSov with resources for researchers.

The MDSov landing page states encouragement for researchers to ‘...consider responsiveness to Māori and Māori data sovereignty in grant and ethics applications and throughout the research data lifecycle.’ The landing page describes what MDSov is, referencing the TMR principles discussed above. There are also helpful links to further resources and links to pages covering high‐level external mechanisms like the FAIR and CARE principles for Indigenous data.

There are also sporadic references made to MDSov in university‐level strategy documents like the University's data strategy: Rautaki Raraunga, and references for consideration in the recently launched data management portal. While these shifts across the ecosystem go some way to provide researchers with support for considering MDSov in their work, they lack integration into mandatory processes or accountability frameworks. Critically, there appear to be no clear institutional processes ensuring researchers work in alignment with MDSov principles, nor tools for enabling MDSov compliance or supporting implementation.

7. Conclusion and Continuation

For researchers working in universities in Aotearoa, the alignment of research with MDSov principles is ‘highly recommended’ rather than required, leaving it up to individual researchers whether to oblige. The lack of a formal process or accountability mechanism leaves MDSov more aspirational than operational. This sentiment was expressed in 2022 with the publication of the IIRC22 Communique (IIRC22 IDSov Collab 2022) and in the statement from the GIDA (Prehn et al. 2023)

The case study above, of Waipapa Taumata Rau, further demonstrates that universities are not necessarily hostile to MDSov in principle, but we are working in an environment that has historically been characterised by bureaucratic inertia. The machinery of how universities operate has been built without MDSov in mind, and that machinery has its own momentum that is very difficult to redirect. Difficult, but not impossible.

This institutional stagnation when it comes to MDSov contrasts sharply with significant external developments in Indigenous and Māori data governance. Key advances include the establishment of the Māori Data Governance Model (Kukutai, Campbell‐Kamariera, et al. 2023), the Māori Data Privacy Framework (Kukutai, et al. 2025), and the Waitangi Tribunal (2021) recognition of Māori data as potential taonga warranting protection under Te Tiriti o Waitangi (Kukutai, Cassim, et al. 2023). Together, these developments set a clear expectation that universities act as kaitiaki of Māori data. This means universities must recognise Māori research data governance and embed policy, procedures and consequences for those failing to uphold and affirm MDGov. In the case of Waipapa Taumata Rau, there is an opportunity now to update the RDM DCMM to reflect the Māori Data Governance Model. Doing so would mean that the DCMM can offer practical steps to support the University to move from initial to optimised and realise its audacious aspirations.

The growth in the size and scope of Māori research, attributed in part to VM, requires universities in Aotearoa to think about their role as kaitiaki of Māori data. Meaningful implementation of Māori Research Data Governance could help to overcome some of the barriers that have historically impeded Māori research rights. The uptake of MDSov in universities represents the opportunity to be world‐leading in Indigenous data practices and is a positive step forward, but its successful implementation will depend on universities taking meaningful actions to create data ecosystems that enable Māori to derive both individual and collective benefit.

Funding

This study was supported by Ngā Pae o te Māramatanga (25‐28RP03 Auaha).

Conflicts of Interest

The authors declare no conflicts of interest.