ETD

• biocultural knowledge
• CARE principles
• collective rights
• Colombia
• data protection law
• data subject
• GDPR
• indigenous data sovereignty
• legal pluralism
• subsidiarity

This thesis examines a structural friction between contemporary data-protection law and Indigenous Data Sovereignty (IDS). Article 4(1) GDPR defines its subject as an identified or identifiable natural person, and every downstream protection — consent, purpose limitation, minimisation, erasure — presupposes that singular, severable individual. IDS, together with African relational philosophy (Ubuntu), Latin American decolonial thought, and Catholic Social Teaching's newest articulation (Magnifica Humanitas, 2026), converges on a different premise: personhood, and the data describing it, can be relational and collective. The thesis argues the friction is structural within the individualist paradigm the GDPR family instantiates, not a limit of law as such. Through a legal-forms matrix (contract, licence, community protocol) and Colombia's 1991 constitutional substrate, it shows that collective data subjects are already carried by non-statutory and constitutional law, while data-protection statutes accommodate commercial non-state ordering more readily than Indigenous ordering of comparable structure. Using comparative doctrinal method across the GDPR, the AI Act, the Data Governance Act and Colombian law, and reading Indigenous instruments (OCAP®, CARE Principles, Te Hiku, FNHA) on their own terms, the thesis concludes that pluralist data regulation is legally available: what is missing is not legal capacity but the decision to extend it, together with the implementation such a decision would still require.