2.1. Development of the HDG Principles

The HDG Principles are claimed to have been developed under the stewardship of Transform Health in consultation with ‘200 contributors from 130 organisations’ using an ‘all-inclusive, multistakeholder’ approach (Holly et al. Reference Holly, Venkatasubramanian and Udayasankaran2023). Transform Health convened four regional consultation workshops in Asia, Latin America, Africa and the Middle East/North Africa, as well as a subsequent global workshop (Holly et al. Reference Holly, Venkatasubramanian and Udayasankaran2023). From these workshops, a draft set of principles was developed and widely disseminated for a one-month public consultation, which resulted in further refinement of the principles (Holly et al. Reference Holly, Venkatasubramanian and Udayasankaran2023). This method of collaborative development is likely to have fostered a sense of shared ownership and commitment among stakeholders, which is crucial for the effective implementation of complex governance frameworks. However, while the process was apparently concerned with protecting both individual and community rights, desiring to ‘encourage wider community ownership and adoption at individual country level’ (Holly et al. Reference Holly, Venkatasubramanian and Udayasankaran2023, pp. 8, 10), it is not clear to what extent, if any, civil society actors operating at the community or national levels, or community representatives from different societies, were part of these consultations.

2.2. Content and purpose of the HDG Principles

The HDG Principles aim to address risks of harm arising from the digitisation of health by utilising equity- and human rights-based principles from international instruments and heavily borrow the legalistic and technical language of the EU General Data Protection Regulation (GDPR). There are eight HDG Principles that fit within three interrelated objectives. The first objective is to ‘Protect People’, which underscores a broadly articulated imperative to shield individuals and communities from potential harms associated with health data use, particularly for marginalised populations. This objective emphasises the importance of protecting data privacy and security in building trust in health data systems through transparency and accountability mechanisms throughout the data life-cycle. The second objective is to ‘Promote Health Value’, which entails unlocking the transformative potential of health data for public benefit and enabling innovation for the achievement of Universal Health Coverage (UHC) objectives. The third and final objective is to ‘Prioritise Equity’ which insists on the equitable distribution of benefits derived from health data use across all populations, everywhere. It also emphasises the importance of empowering individuals to understand and assert their rights regarding their health data. These principles collectively call for an equity- and human rights-based approach to health data governance and aim to balance the necessity of health data utilisation to maximise public benefit with the ethical imperative to safeguard individual and community rights against health data misuse. Each HDG Principle contains several ‘core elements’, and taken together they define best practice relating to the collection, access, use, ownership, sharing and storage of health data to prevent the misuse of unprotected health data.

2.3. Impact and critique of the HDG Principles

Transform Health has said that a global health data governance framework ‘can help build consensus across countries around needed legislative and regulatory provisions’ (Transform Health 2025). Although the assumption that global consensus is both needed and wanted on the issue of health data governance could be interpreted as denying diverse epistemologies and imposing the same infantilising logic that underpins colonially-grounded regimes of power. The ‘added value’ of the HDG Principles is said to be that they ‘recognise and build upon existing norms, principles and guidelines’ (Holly et al. Reference Holly, Venkatasubramanian and Udayasankaran2023, p. 9), but such approaches run the risk of deepening existing power relations in global governance models and privileging the epistemologies of knowledge producers in the Global North. This risk is heightened by the lack of meaningful consultation at the community level.

After designing the HDG Principles, Transform Health called on a wide range of stakeholders, including civil society organisations, private actors, governments and other public bodies, to endorse the HDG Principles (Transform Health 2022a). To endorse them meant making an explicit commitment to implement the HDG Principles in organisational programmes and policies. According to Transform Health, as of writing, 170 organisations and three governments have endorsed the HDG Principles (Transform Health 2022a). The widespread endorsement of the HDG Principles demonstrates that they have been received by many on an international scale as a critical instrument in the ongoing effort to establish equitable and responsible digital health ecosystems (World Bank 2025).

Transform Health has robustly advocated for the principles to serve as a foundational document for the development of national health data governance frameworks globally. Transform Health has now created a ‘Model Law on Health Data Governance’, which is intended to be ‘a blueprint for strengthening national legislation’ (Transform Health 2024). The HDG Principles are a more deliberative form of international governance. As such, they sit outside the United Nations’ international law-making process for human rights instruments and outside the World Health Organization’s (WHO) mandate on international health governance. This aspect has made the HDG Principles an interesting site of original study, in that they lack the institutional legitimacy of traditional law-making that occurs in the international system. Transform Health has retrospectively sought such legitimacy by calling for global consensus on the HDG Principles, arguing that they should underpin a global framework for health data governance through the World Health Assembly. If adopted there, the HDG Principles would become legally binding on WHO member states.

In response to the model law, digital health and human rights scholars were quick to offer ‘seven provocations’ to Transform Health, calling for further debate around key issues (Davis et al. Reference Davis, Sekalala and Serra2024). These provocations offer a timely intervention into ongoing debates about global health data governance initiatives. While the model law echoes the aspirations of the HDG Principles to promote equitable, rights-based standards for national health data systems, Davis and colleagues caution that its current formulation risks reproducing the very asymmetries it seeks to dismantle (Davis et al. Reference Davis, Sekalala and Serra2024). Their critique serves as a call for re-imagining health data governance in ways that align with the principles of data justice, epistemological delinking and culturally resonant rights-based approaches. The empirical insights discussed below expose a profound disconnect between global standards and local contexts, which supports the concerns raised by Davis et al. (Reference Davis, Sekalala and Serra2024).

3.1. Aims of the study

The aim of the HDGP study was to assess organisational perceptions and the level of operationalisation of the HDG Principles. In so doing, it was hoped that the responses would yield important insights into how the HDG Principles could help or hinder the rights-based regulation of health data for citizens and communities from different regions of the world.

3.2. Methodology

The HDGP study was funded by the Wellcome Trust and is part of a broader project entitled ‘There is no app for this: Regulating the Migration of health data in Sub-Saharan Africa’ which analyses the regulation of health apps and the governance of health data. The author has never worked for Transform Health, and the data obtained throughout the HDGP study were collected and analysed independently by the author. Ethical approval was obtained through the University of Warwick’s Humanities and Social Sciences Research Ethics Committee to carry out this research (reference no. HSSREC 161/21–22).

The author contacted Transform Health to inform them of the purpose of the HDGP study, and two meetings took place between the author and three representatives of Transform Health in early 2023. The only selection criterion for the HDGP study was that participants had to be representatives from organisations (including government departments) who had formally endorsed the HDG Principles. Given that Transform Health privately held the information of the organisational representatives who had, at the point in time (August 2023), formally endorsed the HDG Principles, Transform Health’s assistance was needed to recruit participants to the HDGP study. It was also foreseen that this indirect recruitment approach (i.e. through Transform Health) would ensure the complete anonymity of the participants, given that the author, as the research investigator, would not have direct contact with the participants. Following this approach, the author drafted a covering email containing all the details of the HDGP study, which was sent to a representative at Transform Health, who then agreed to disseminate those details to all 130 organisations that had already endorsed the HDG Principles as of 1 August 2023. Representatives for the endorsing organisations were in this way invited to participate in the HDGP study by completing the online survey within a period of six weeks.

In the email communication, prospective participants were directed to a Qualtrics hyperlink with an online Participant Information Leaflet (PIL). This PIL contained detailed information about the HDGP study, its rigorous ethical safeguards and how their anonymous contributions would be protected, including when later published in research publications. Once participants were content that they understood the purposes of the study and their rights pursuant to it, participants were able to complete an online consent form. Only after informed consent had been given would the online form direct them to the survey questions. Participation was completely voluntary, and no payment or other material incentives were offered for taking part.

The HDGP study involved participants completing an online survey that was created and analysed through the survey platform Qualtrics. It contained a mixture of nineteen quantitative and qualitative survey questions. The questions were designed to increase understanding of: (a) how the HDG Principles are being implemented/operationalised by organisations that have endorsed them; (b) how the HDG Principles are perceived by endorsing organisations to be effective in protecting and promoting equity and human rights; (c) any drawbacks inhibiting full implementation of them; and (d) the ways in which the HDG Principles might be improved. Granted, the online survey method has limitations in the volume and quality of qualitative data collected, but participants were given space on the online survey to expand on their points as much as they liked.

Of the organisations the survey was sent to, twenty-eight consents and responses were received. Not all the organisations responded to every question on the survey, as each question was set up as being optional. As such, the analysis of quantitative data does not always equate to responses by twenty-eight participants. No personally identifiable data was collected, so the author is not aware of which specific organisations or individuals participated in the study. At least sixteen participants were not-for-profit/civil society organisations, three were private-sector organisations, two were international organisations, one was a government body and one identified as a consortium of universities and civil society actors. Responses were received from organisations either based in, or working in the following twenty countries: Colombia, Ghana, Haiti, Indonesia, Israel, Kenya, Macaronesia, Malawi, Mexico, Nigeria, Portugal, Senegal, South Africa, Sri Lanka, Switzerland, Tanzania, UK, USA, Vietnam and Zambia. In terms of the size of the participant organisations by number of employees, ten had fewer than fifty staff, two had between 50–500 and one had between 5,000–50,000. Five organisations were operating at the community level, twelve at the national level, two at the regional level and two at the global level.

3.3. Findings

Analysis of the survey responses through Qualtrics identified four key themes, which are outlined below. They are: (1) rights-based approaches to health data governance; (2) safeguarding; (3) democratising access to information and health provision; and (4) capacity building.

(1) Rights-based approaches to health data governance

Survey participants were asked about the importance of protecting the human rights (in particular, the rights of privacy and health data protection) of individuals and communities to their organisation. Sixteen participants stated that these rights were extremely important and six said that they were very important. Seventeen organisations identified human rights advocacy as one of their core objectives, two were not sure if this was a main objective of their organisation and three said that it was not a main organisational objective. Despite Transform Health’s claims that the HDG Principles were driven and developed by civil society through an ‘inclusive, bottom-up process’ (Transform Health 2022b), the findings of the study indicate that some human rights organisations, particularly those operating at the community and national levels, were excluded from the process of developing the HDG Principles. With no public transparency about the ratio of private, public and civil society actors involved in the design of the HDG Principles, and about which level they operated at, it is unclear how inclusive this process actually was.

When asked what strategies the organisations were using to operationalise the HDG Principles, most participants wanted to use the HDG Principles to strategically improve health data governance through developing more equitable policy and legal frameworks for health data use. By contrast, some participants also saw the HDG Principles as being important for popularising resistance to extractivist data agendas and for creating awareness of universalist health data governance approaches (Participant 2, Africa and Latin America; Participants 21 and 25, East Africa).

However, ways to achieve these aims in culturally resonant ways were a source of uncertainty and, at times, frustration. Although fourteen participants conceded that the HDG Principles had been designed in a way that made it easy for their organisation to understand and utilise, some participants noted that the HDG Principles were ‘too abstract’, ‘very idealistic’ or ‘vague and self-contradictory’ (Participant 2, Africa and Latin America; Participants 21 and 25, East Africa). One participant noted that, on the face of it, the HDG Principles ‘align with our operational focus on mainstreaming community rights and gender’ but ‘they fail to educate anyone on what health data governance entails and what it means for service seekers in practice’ (Participant 18, East Africa). Some participants believed that case studies demonstrating where the HDG Principles had been operationalised within specific contexts would be helpful because, without these, the HDG Principles are ‘too theoretical to have much practical value within national settings and communities’ (Participant 2, Africa and Latin America; Participants 21 and 25, East Africa).

Four participants specifically said that more targeted communication with national governments and community representatives is needed for ‘serious engagement’ on concerns relating to health data on the ground (Participant 11, West Africa; Participant 14, Central Africa; Participant 20, South East Asia; Participant 27, Central America). About half the participants stated that providing local language translations of the HDG Principles would also improve accessibility and uptake, but that, overall, there were challenges in navigating the differences in how communities viewed data protection, which did not always align with how the HDG Principles had been framed. One participant felt that ‘universal governance models’ that use the language of global human rights ‘feels like a bit of an imposition’ and said that ‘we never had a chance to tell them what rights we actually need and what rights look like for us, these [the HDG Principles] are better than nothing I guess’ (Participant 2, Africa and Latin America). There was also a strong sense that the HDG Principles were simply a replication of existing human rights and data protection principles that can be useful to generate understanding of a high-level ideal but are ‘out of touch’ with what is appropriate for community members with diverse needs (Participants 1, 18, 21 and 25, East Africa; Participant 2, Africa and Latin America). Other participants said that, while it was important for the HDG Principles to uphold human rights principles, the HDG Principles would need to be carefully adapted at regional, national and community levels to ensure they are contextually fit and safe for purpose (Participants 1, 3, 18, 19 and 25, East Africa; Participant 2, Africa and Latin America; Participant 11, West Africa; Participant 13, Western Europe; Participant 14, Central Africa; Participant 20, South East Asia; Participant 27, Central America). In particular, many of these participants felt strongly that not enough was being done to empower local communities to know their rights and to co-develop culturally appropriate redress mechanisms for rights violations.

While frameworks relying on human rights principles are often stated in broad terms to allow for varied interpretations and subjective applications, this abstract nature may cause confusion around meaning and application, and even more challenging are the additional considerations of operating in a resource-constrained setting with diverse cultural understandings of rights and values. Despite the abstract nature of the HDG Principles being identified by some participants as a source of obstruction, such flexibility can create space for inclusive participation in processes of vernacularisation of human rights or unique applications of data sovereignty. As one participant said: ‘The most interesting examples [of health data governance frameworks] are localised, e.g. indigenous data governance protocols in Australia’ (Participant 2, Africa and Latin America).

(2) Safeguarding

Safeguarding health data is a pressing concern, particularly in light of persistent global inequities and the growing risks associated with digital health systems. The misuse of health data – through unauthorised sharing, commercial exploitation or discriminatory application – poses significant ethical and political challenges (Tisné Reference Tisné2020). The majority of participants argued that the HDG Principles might be a way to ensure health data is kept confidential, and the importance of confidentiality in health service provision was seen by participants as vital to safeguarding initiatives. In particular, participants communicated a need to protect marginalised communities, such as those affected by diseases (including HIV) or those who want to enjoy freedoms that are stigmatised and criminalised in some countries (such as ‘women seeking abortion’ and ‘sexual minorities/members of LGBTI groups’) (Participants 3, 4 and 18, East Africa; Participant 12, Latin America; Participant 15, Western Europe; Participant 20, South East Asia). As Sarah Esther Lageson (Reference Lageson2020) articulates, the rise of ‘digital punishment’ and the implications for criminal justice prosecution are a real concern for many, as is the increased potential for forms of stigma and discrimination. This risk of punishment and persecution is heightened for certain groups in particular regions, with health data having the potential to reveal intimate personal details of a person’s lifestyle and choices.

Hostile trends in criminalising marginalised groups are understandably an ongoing concern of human rights organisations globally, and the safeguarding of health data offers some protection from forms of arbitrary punishment. That the HDG Principles have not explicitly engaged with how to address forms of digital punishment, was felt by some participants to be missing the critical struggles faced by those at risk of it. Safeguarding was seen as something incredibly important that needed multilevel engagement, without which, ‘dangerous assumptions about [our community] are made by some random man behind a desk in America or Europe who has never stepped foot in our countries’ (Participant 2, Africa and Latin America).

At the community level, safeguarding mechanisms were seen by many participants as ways to ensure that health data practices are culturally appropriate, ethically sound and responsive to the lived realities of diverse populations (Participants 1, 3 and 25, East Africa; Participant 2, Africa and Latin America; Participant 11, West Africa; Participant 13, Western Europe; Participant 14, Central Africa; Participant 20, South East Asia; Participant 27, Central America). In many contexts across the Global South, there is deep-rooted mistrust toward external actors – particularly researchers, NGOs or governments – due to histories of extractive data practices and exploitative health interventions. Without community-level oversight, health data initiatives may inadvertently reinforce social exclusion or perpetuate stigma, particularly around sensitive issues. Civil society actors at the national, regional and global levels can also play a strategic role in safeguarding by co-creating culturally resonant mechanisms to facilitate health data justice (Taylor and Broeders Reference Taylor and Broeders2015).

(3) Democratising access to information and health provision

Almost all participants stressed the importance of digital technology for democratising health provision, especially in African countries. They saw enabling citizen access to accurate health information about them, ensuring data-based health provision and safeguarding human rights (particularly the right to privacy) as crucial aspects of such democratisation. One participant noted that it has been challenging to help communities protect their data because ‘people did not have any idea of what health data governance entailed, including the service seekers themselves’ (Participant 18, East Africa). Another participant said that it was promoting the implementation of digital health tools ‘for the democratization of health’ specifically, and that ‘democratization of access to information is fundamental to this’ (Participant 12, Latin America). Some organisations saw the HDG Principles as useful for empowering youth to lead mentorship programmes (particularly at the community level in African countries) aimed at educating communities and new generations on the importance of health data protection and health data ownership (Participants 1, 18 and 24, East Africa).

(4) Capacity building

While many of the participants were receptive to the implementation of the HDG Principles, acknowledging that they addressed an important gap in the governance of health data, challenges in implementation were well communicated. A lack of funding to operationalise the HDG Principles was a key concern of the participants. Such responses are indicative of a mixture of both for-profit and not-for-profit organisations, with the majority being in the latter category. Where organisational funding comes from can have an impact on implementation based on the limitation of resources, conditions attached to funding arrangements or by profit incentives that do not prioritise human rights-based approaches. When asked whether participants had a specific budget internally to aid implementation of the HDG Principles, only one organisation responded ‘Yes’, thirteen responded ‘No’ and three stated that they did not, but that they planned to make provision for this in future. A lack of digital literacy, technical expertise and difficulties around the provision of training for staff and stakeholders were also identified as a barrier to implementation.

A common strategy stated to get around many of these challenges was to form organisational partnerships and alliances to collectively operationalise the HDG Principles in context-specific ways with like-minded organisations. The types of promising partnerships mentioned by participants were with NGOs (predominantly NGO to NGO partnerships), members of broader NGO coalitions, multilateral initiatives, global organisations (such as WHO and other UN bodies), community health organisations and networks, educational institutions, youth-led networks, as well as public figures and social media influencers (for public information dissemination). Partnerships were communicated by the majority of participants as being particularly important for capacity building (especially for emerging and growing NGOs in the Global South), and for developing effective reference frameworks for programming (Participants 3, 19 and 24, East Africa; Participant 14, Central Africa; Participants 20 and 23, South East Asia; Participant 22, South-Central Asia).

Other strategies identified included converting partnerships into ‘joint resource mobilizations’, ‘collectively petitioning relevant government institutions’, ‘mounting public awareness campaigns’ and ‘advocating for health data governance standards at the regional level’ (Participants 3, 18, 19 and 24, East Africa; Participant 14, Central Africa; Participant 23, South East Asia). A few other participants expressed plans to widely disseminate the HDG Principles in order to create and strengthen partnerships with other organisations through joint consultation and co-led research. Part of this strategy involved the exchange of information, the sharing of tools and the pooling of synergies (Participant 1, East Africa; Participant 14, Central Africa). Participants operating at the community level had far more to say and took a keener interest in co-developing human-rights approaches within their jurisdictions. Such participants clearly understood the specific concerns people had, demonstrating their direct engagement with community members on the ground, and expressed a desire for greater visibility and participation in digital health advocacy projects.

4.1. Health data justice

Datafication presents new avenues for injustice, particularly for marginalised groups, and the framework of ‘data justice’ incorporates the pursuit of fairness and rights-based approaches in the processes of collection, use and control of data (Taylor Reference Taylor2017; Dencik and Sanchez-Monedero Reference Dencik and Sanchez-Monedero2022). Importantly, the concept of data justice offers a critique of how data systems reproduce social, economic and racial inequalities, while offering alternatives rooted in democratic accountability and participatory governance (Dencik et al. Reference Dencik, Hintz and Cable2016). Data justice also demands that the benefits of data-driven technologies and innovations must be distributed equitably, especially for those marginalised communities that have historically been exploited or misrepresented through data practices and excluded from the benefits of data collection and use (Dencik et al. Reference Dencik, Hintz and Cable2016; Taylor Reference Taylor2017; Dencik et al. Reference Dencik, Hintz, Redden and Treré2019; Dencik and Sanchez-Monedero Reference Dencik and Sanchez-Monedero2022).

Shaw and Sekalala (Reference Shaw and Sekalala2023) extend the idea of data justice further by defining the concept of ‘health data justice’ which explicitly prioritises data justice aims in digital health ecosystems. Health data justice acknowledges the potential for health data collection, retention and use by various actors to perpetuate and intensify existing colonial systems of inequality within health care and public health (Shaw and Sekalala Reference Shaw and Sekalala2023). To counteract these inherent risks and historical harms, health data justice seeks to establish new, ethically robust norms for the governance of health-related data that are directly informed by the needs, lived experiences and articulated wishes of structurally marginalised communities (Shaw and Sekalala Reference Shaw and Sekalala2023).

This framing helps activists and policy-makers to reorient the focus toward a broader sociopolitical vision of justice in the digital age. Within a decolonial lens, safeguarding in particular becomes a mechanism for resisting data harms caused by the instrumentalisation of health data for malevolent interests. By interrogating who is protected, from what and by whom, safeguarding pursuant to understandings of health data justice becomes an intervention that centres emancipatory praxis (Akbari Reference Akbari2025). This foregrounds the historical harms experienced by marginalised communities and actively seeks to dismantle the systems that reproduce them.

4.2. Epistemological delinking

Civil society organisations operating in the health space are mobilising in radically different ways than before, prioritising the embedding of rights language in governance structures (Sekalala and Rawson Reference Sekalala and Rawson2022). Rights-based approaches can certainly underpin health data justice goals. Yet, by uncritically accepting the content and form of universal principles, there is a risk of replicating the narratives that privilege existing power dynamics and Western epistemologies. The concept of ‘epistemological delinking’ emphasises the need to break away from Eurocentric modes of knowledge production that were imposed during colonialism to reclaim pluralistic and historically marginalised epistemologies (Quijano Reference Quijano2000; Dussel et al. Reference Dussel, Krauel and Tuma2000; Mignolo Reference Mignolo2000, Reference Mignolo2007). Delinking from the colonial matrix of power involves questioning the very foundations of Western modernity and its universalising claims, and revisiting what counts as ‘legitimate’ knowledge (Couldry and Powell Reference Couldry and Powell2014; Milan and Treré Reference Milan and Treré2019; Madhok Reference Madhok2022).

The correlation between data justice and epistemological delinking becomes clear when we consider how much of the dominant approach to data collection, use and ownership is rooted in scientific and technological epistemologies produced in the Global North. This may lead to the violent imposition of data practices that are not appropriate or beneficial for diverse communities in the Global South (Makulilo Reference Makulilo2013; Ricaurte Reference Ricaurte2019). Thus, epistemological delinking in this context means questioning these dominant paradigms and seeking alternative, culturally situated approaches to data, to prevent marginalised groups from being discriminated against and wronged in their capacity as knowers (Fricker Reference Fricker2007; Symons and Alvarado Reference Symons and Alvarado2022). Democratising access to information, for instance, challenges epistemic dominance through epistemological delinking – severing the dependency on knowledge that derives from colonial paradigms and affirming the epistemic agency of communities long rendered invisible or unintelligible within global health systems. Additionally, Western models of capacity building in the case of civil society actors often reproduce colonial logics of ‘development’ and reinforce dynamics of economic and legal dependency. Reframed through a decolonial lens, capacity building becomes an intervention that supports emancipatory praxis – by building the epistemic infrastructures necessary for self-determination (Mignolo Reference Mignolo2009). In the digital space, this translates to ‘data sovereignty’, where communities assert their right to control, own and govern their own data according to their own epistemologies. Capacity building can thus function as a counter-hegemonic force, equipping communities to not only manage their own data but to re-shape the conditions under which knowledge and rights are defined and made legible.

In essence, data justice provides a concrete arena where the principles of epistemological delinking can be applied. Together, these approaches recognise that data justice requires a fundamental re-imagining of how data is conceived, created, used and owned, drawing on a wide array of knowledge systems and prioritising the self-determination of communities and nations.

4.3. Vernacularisation of human rights

Many national data protection regimes, particularly in the Global South, have been modelled on the GDPR, yet often without sufficient adaptation to specific sociocultural, historical or political contexts (Makulilo Reference Makulilo2013; Mannion Reference Mannion2020; Mukiri-Smith and Leenes Reference Mukiri-Smith and Leenes2021; Greenleaf and Cottier Reference Greenleaf and Cottier2022). These universalising frameworks frequently overlook the diverse epistemological foundations that shape understandings of rights norms across different societies. In some African contexts, for instance, conceptions of privacy are shaped by communal values rather than by the liberal individualism that underpins Western legal frameworks (Olinger et al. Reference Olinger, Britz and Olivier2007). Here, the protection of personal data may be understood less as an individual right and more in relation to its potential contribution to the well-being of the wider community (Tisné Reference Tisné2020). The imposition of Western-centric data protection norms, particularly in regions marked by histories of colonial and (neo)colonial exploitation, raises critical questions about the appropriateness and legitimacy of universal governance frameworks that do not reflect the priorities or worldviews of diverse groups. This calls for a more context-sensitive and pluralistic approach to data protection – one that recognises the legitimacy of alternative normative orders and seeks to decolonise dominant legal paradigms (Merry Reference Merry1988).

The vernacularisation of human rights, coined by anthropologist Sally Engle Merry, refers to a process of translating and adapting the abstract language of human rights into meaningful, local idioms and frames of meaning, making them more accessible and actionable for communities (Merry Reference Merry2003, Reference Merry2006; Levitt and Merry Reference Levitt and Merry2009). Merry emphasised legal pluralism’s basic premise that multiple legal systems can co-exist and attempted to locate a compromise between the polarised positions in rights discourse adopted by universalists on the one hand, and cultural relativists on the other (Merry Reference Merry1988, Reference Merry2003, Reference Merry2006). ‘Intermediaries’ – who are those involved in the translation and adaptation of rights – negotiate local, regional, national and global systems of meaning, translating internationally circulating rights discourses to particular societal contexts and reframing global rights issues as locally understood grievances (Merry Reference Merry2006; Levitt and Merry Reference Levitt and Merry2009). Multiple vernaculars of human rights are to be expected within any given context, contributing to the emergence of competing understandings of human rights (Gregg Reference Gregg2011). Vernacularisation implies not only local adaptation but also epistemic transformation. To the extent that these efforts generate new normative vocabularies and governance models responsive to realities on the ground, they can indeed be seen as advancing a decolonial, vernacularised form of human rights. This demands meaningful participation of civil society and community representatives in the development and implementation of health data policies and governance frameworks to ensure that normative understandings of rights are not top-down impositions but are co-created with the very communities they are meant to serve.

Vernacularisation of rights, and its interrelated processes of epistemological delinking, constitute a challenge to the colonial devaluation of indigenous knowledge in part by extending understandings of health beyond Western clinical definitions and the unsavoury remnants of eugenic thought (Hollenberg and Muzzin Reference Hollenberg and Muzzin2010). In the context of health data protection, human rights principles related to data (e.g. privacy, consent, participation, benefit sharing) need to be translated and adapted into local languages and culturally specific epistemological frameworks. This goes beyond mere linguistic translation to a deeper cultural translation, ensuring that the essence of these rights is understood and owned within local contexts. Understandings of self-determination and the concept of data sovereignty are crucial for empowering communities to not only control and benefit from their data but to safeguard against exploitation by external entities, counteracting risks of data colonialism (Olorunju and Adams Reference Olorunju and Adams2023).

4.4. Health data justice, epistemological delinking and vernacularisation in action

Despite the structural challenges faced by civil society actors in deploying these three decolonial frameworks, there are compelling examples where vernacularised rights approaches to health data governance have been successful, illustrating how they can work not only in theory but in practice.

In Canada, the First Nations Principles of OCAP® (Ownership, Control, Access and Possession) represent a robust, Indigenous-led data governance framework that affirms the collective rights of First Nations over their own data, operationalising Indigenous epistemologies and prioritising data sovereignty and self-determination (FNIGC 1998). This model directly challenges regulatory frameworks that have historically extracted data from Indigenous communities without consent or reciprocity (Schnarch Reference Schnarch2004). The principles of OCAP® are a vernacular translation of the right to self-determination in the United Nations Declaration on the Rights of Indigenous Peoples, as well as the rights to privacy, health and benefit-sharing, into a framework that resonates deeply with First Nations worldviews, legal traditions and collective aspirations.

In New Zealand, the Māori Data Sovereignty principles assert that data relating to Māori must be subject to Māori governance in accordance with their customary practices (Kukutai Reference Kukutai2019; Kukutai et al. Reference Kukutai, Campbell-Kamariera and Mead2023). These principles not only protect against the epistemic violence of datafication and misrepresentation but also embed relational and holistic worldviews into data infrastructures and ensure ‘culturally grounded models of protection and care’ (Kukutai Reference Kukutai2019; Kukutai et al. Reference Kukutai, Campbell-Kamariera and Mead2023). Additionally, more recently in Australia, the Framework for Governance of Indigenous Data specifically recognises that Indigenous data sovereignty is crucial in addressing historical and continuing issues of data exploitation, misrepresentation and the marginalisation of First Nations people (National Indigenous Australians Agency 2024).

These models serve as powerful demonstrations of epistemological delinking in action, where communities exercise sovereignty over data in ways that align with their ontologies and social realities. They also affirm that knowledge as emancipation is not an abstract ideal but an achievable goal, particularly when supported by institutional recognition and legal frameworks that respect Indigenous authority. In doing so, they stand as vital counterpoints to the technocratic, ‘one-size-fits-all’ paradigms that dominate global health governance, and offer instructive pathways for civil society actors elsewhere – especially in the Global South – who seek to localise health data principles under historical and enduring conditions of structural constraint. These initiatives are integral to the project of epistemological delinking and are essential for constructing health data governance frameworks that are equitable, contextually grounded and reflective of diverse epistemologies and realities.