This glossary provides plain-language definitions of key terms in
Māori data sovereignty,
data residency,
AI governance,
AI bias,
algorithmic lookism, and
facial recognition technology (FRT) bias in Aotearoa New Zealand.
It is informed by the Waitangi Tribunal’s
Wai 2252 report and Taiuru & Associates’ work on Māori AI, data sovereignty, and technology governance. Wai 2252 defines Māori data as digital or digitisable information or knowledge that is about or from Māori people, language, culture, resources, or environments. It also affirms that Māori data is a taonga and is subject to Māori governance.
Māori data definitions
Māori data
Digital or digitisable information or knowledge that is about or from Māori people, language, culture, resources, or environments. Māori data includes data held by whānau, hapū, iwi, marae, Māori organisations, government agencies, businesses, and researchers.
Under Wai 2252, Māori data is a
taonga: a living, strategically valuable treasure that is subject to tikanga Māori and Māori governance.
Māori data sovereignty
The inherent right of Māori, whānau, hapū, iwi, marae, and rōpū Māori to exercise control over Māori data and Māori data ecosystems.
Wai 2252 frames Māori data sovereignty as
Māori data governance: the principles, structures, accountability mechanisms, legal instruments, and policies through which Māori exercise control over Māori data.
Māori data governance
The practical implementation of Māori data sovereignty. It includes the rules, roles, tikanga-based safeguards, decision-making structures, consent processes, storage arrangements, and accountability mechanisms that determine how Māori data is collected, classified, accessed, used, shared, stored, and reused.
Taonga
A treasured possession, resource, or intangible value. Wai 2252 recognises Māori data as a taonga, meaning it carries cultural, strategic, and intergenerational value and requires protection under tikanga Māori.
Māori data ecosystem
The people, organisations, systems, infrastructure, laws, tikanga, data, metadata, and relationships involved in creating, holding, governing, and using Māori data.
Māori data taxonomy
A structured way of classifying Māori data according to its source, sensitivity, cultural status, governance requirements, access conditions, and permitted uses. A taxonomy may include classifications such as tapu, noa, and rāhui.
Tapu
Sacred, restricted, or protected. In Māori data governance, tapu data may require restricted access, specific tikanga, cultural protocols, or limitations on reuse.
Noa
Unrestricted, ordinary, or free from restriction. Noa data may be more openly accessed or reused, subject still to appropriate consent, privacy, security, and Māori governance requirements.
Rāhui
A temporary restriction or protective pause. In data governance, a rāhui may be applied to restrict access to, use of, or linking of data while risks, harms, or cultural concerns are addressed.
Kaitiakitanga
Guardianship, stewardship, and protective responsibility. In Māori data governance, kaitiakitanga means safeguarding Māori data and digital taonga for current and future generations.
Tino rangatiratanga
Māori self-determination and authority. In data and AI governance, it supports Māori authority to determine how Māori data and AI systems affecting Māori are governed.
Mana whakahaere
Effective stewardship, authority, and control. In AI governance, mana whakahaere recognises Māori data as a taonga and requires meaningful Māori oversight of systems that use or affect it.
Active protection
A Te Tiriti obligation requiring the Crown and other organisations to take positive steps to protect Māori rights and interests. In AI and data governance, it includes ensuring equitable outcomes for Māori and obtaining free, prior, and informed consent for the use of Māori data.
Free, prior and informed consent (FPIC)
Consent obtained before data collection or use begins, without coercion, and with enough clear information for people to understand the purpose, risks, benefits, and choices available.
Data sovereignty and data residency
Data sovereignty
Authority and control over data, including who governs it, who can access it, under what laws it is held, and how it may be used. Data sovereignty is not only about where data is stored; it is about who has decision-making power over the data and its ecosystem.
Māori data sovereignty
The inherent rights and interests Māori have in relation to the creation, collection, access, analysis, interpretation, management, dissemination, reuse, and control of data relating to Māori, whānau, hapū, iwi, and Māori organisations.
Māori data sovereignty is grounded in Article II of Te Tiriti o Waitangi and recognises that Māori data should be governed by Māori, not merely stored in New Zealand.
Data residency
The physical or legal location where data is stored, processed, backed up, or hosted. Data residency is often described by jurisdiction—for example, data hosted in Aotearoa New Zealand, Australia, the United States, or the European Union.
Data residency is important because data may become subject to the laws, surveillance powers, disclosure rules, and government access regimes of the country in which it resides.
Data localisation
A requirement or policy that data must be stored, processed, or managed within a particular country or jurisdiction. For Māori data, localisation can support greater control, but it does not by itself achieve Māori data sovereignty.
Data jurisdiction
The legal authority that applies to data based on where it is stored, processed, accessed, or controlled. Data held offshore may be subject to foreign laws even where the organisation collecting it is based in Aotearoa New Zealand.
Cross-border data transfer
The movement of data from one country or jurisdiction to another. Cross-border transfers can create risks where overseas laws permit government access, differ in privacy protections, or do not recognise Māori data governance.
Data hosting
The storage and operation of data on physical or cloud infrastructure. Hosting decisions affect residency, jurisdiction, security, availability, vendor dependency, and the ability to apply Māori data governance controls.
Cloud data residency
The location of cloud infrastructure used to store or process data. Organisations should distinguish between the location of the cloud provider, the location of the data centre, the location of backups, and the jurisdictions that may access the system.
Data processing location
The jurisdiction or infrastructure where data is analysed, transformed, modelled, or otherwise processed. Data may be stored in one country but processed in another, creating additional sovereignty and compliance risks.
Data backup residency
The jurisdiction where backup copies of data are held. Backup locations are often overlooked, but they can expose data to foreign laws and create uncertainty about who can access archived information.
Data portability
The ability to move data between systems, providers, or jurisdictions in a usable format. Portability supports Māori data sovereignty by reducing dependency on a single vendor or platform.
Vendor lock-in
Dependence on one supplier’s technology, platform, formats, or contractual terms, making it difficult or costly to move data or change providers.
Data trust
A governance structure in which an independent body holds or oversees data on behalf of a community or group according to agreed rules, purposes, and safeguards.
Data sharing agreement
A formal agreement setting out who may access data, for what purpose, under what conditions, and with what privacy, security, cultural, and accountability safeguards.
AI governance and ethics
Artificial intelligence (AI)
Computer systems that perform tasks associated with human intelligence, such as recognising patterns, generating language or images, classifying information, making recommendations, or supporting decisions.
AI governance
The accountabilities, decision rights, policies, safeguards, and oversight mechanisms that determine how an organisation develops, procures, deploys, and monitors AI systems.
Responsible AI
The design, deployment, and management of AI in ways that are lawful, ethical, safe, transparent, accountable, and consistent with the rights and values of affected communities.
AI ethics
Principles and practices for ensuring AI systems are fair, transparent, accountable, safe, privacy-protective, and respectful of human rights and cultural rights.
AI assurance
Evidence, testing, documentation, and independent review demonstrating that an AI system is safe, effective, lawful, and fit for purpose.
AI risk assessment
A structured process for identifying, evaluating, and managing potential harms from an AI system, including bias, discrimination, privacy loss, cultural harm, security risks, inaccurate outputs, and loss of human control.
AI impact assessment
A structured assessment of the potential effects of an AI system on people, communities, rights, wellbeing, and equity before and during deployment.
Algorithmic accountability
The obligation of people and organisations to explain, take responsibility for, and provide remedies for the actions and outcomes of algorithmic or AI systems.
Transparency
Clear disclosure of what an AI system does, what data and assumptions it uses, its limitations, who is accountable, and how people can query or challenge its outputs.
Explainability
The extent to which people can understand how an AI system produced a particular output or recommendation.
Human oversight
Meaningful human ability to review, intervene in, pause, override, or reverse an AI-supported decision.
Human-in-the-loop
A design approach in which a person reviews or approves AI outputs before they take effect.
Human-on-the-loop
A design approach in which an AI system can operate autonomously, while a person monitors performance and can intervene when needed.
Co-design
Designing a system with the people and communities affected by it, rather than merely consulting them after key decisions have been made.
Co-governance
Shared decision-making authority between an organisation and affected communities, including Māori, over the purpose, design, deployment, and oversight of AI systems.
AI procurement
The process of acquiring AI systems or services, including due diligence on suppliers, data residency, Māori data governance, cultural risks, security, accessibility, and ongoing oversight.
AI lifecycle
The stages of an AI system’s existence: problem definition, data collection, model development, testing, deployment, monitoring, maintenance, and retirement.
AI bias and algorithmic bias
AI bias
Also called machine learning bias or algorithm bias, AI bias occurs when human biases skew training data or AI algorithms, leading to distorted outputs and potentially harmful outcomes. It is an umbrella term for the many forms of bias that can arise across data, models, systems, and deployment.
Algorithmic bias
Systematic errors in machine learning algorithms that produce unfair or discriminatory outcomes. Algorithmic bias often reflects or reinforces existing socioeconomic, racial, gender, and cultural inequalities.
Algorithmic discrimination
Unfair treatment or disadvantage caused by an algorithm or AI system, whether intentional or unintentional. It can affect access to employment, housing, credit, health care, education, policing, and public services.
Algorithmic fairness
Approaches and measures used to assess and reduce unjustified differences in how an AI system treats individuals or groups.
Bias audit
An independent or structured review of an AI system to identify unequal performance, discriminatory outcomes, cultural harms, and opportunities for mitigation.
Bias mitigation
Actions taken to reduce or prevent unwanted bias in data, models, systems, or deployment practices.
Algorithm bias
Bias arising from the way an algorithm is designed, trained, or applied. It can occur when the problem or question is poorly defined, when feedback does not guide the system appropriately, or when the model produces distorted results.
Cognitive bias
Bias introduced through human judgement, assumptions, or personal perspectives during data collection, labelling, model design, or system oversight.
Confirmation bias
Bias that occurs when an AI system or its developers rely too heavily on existing beliefs or trends in data, reinforcing established patterns and failing to identify new ones.
Exclusion bias
Bias that occurs when important data, people, variables, or contexts are left out of a dataset or model, often because developers do not recognise their relevance.
Measurement bias
Bias caused by incomplete or poorly prepared data, including datasets that fail to include the full population or range of experiences that should be considered.
Out-group homogeneity bias
The tendency to see members of one’s own group as diverse while viewing people outside that group as more similar to one another. In AI, this can contribute to poor model performance for communities that developers understand less well.
Prejudice bias
Bias that occurs when stereotypes and faulty societal assumptions are embedded in a dataset or algorithm, leading to biased outputs.
Recall bias
Bias that develops during data labelling when labels are inconsistently applied because of subjective observations or differing interpretations.
Sample or selection bias
Bias that occurs when the data used to train a machine-learning model is too small, incomplete, or unrepresentative of the population the system will affect.
Stereotyping bias
Bias that occurs when an AI system reinforces harmful stereotypes, often unintentionally, through its training data, outputs, or recommendations.
Proxy bias
Bias that occurs when a system uses an apparently neutral variable—such as postcode, school, employment history, or language—as a stand-in for a protected or culturally significant characteristic.
Proxy discrimination
Discrimination that occurs when proxy variables indirectly disadvantage a person or group, even where a protected characteristic is not explicitly used.
Representation bias
Bias that occurs when some people, communities, languages, or experiences are missing, under-represented, or misrepresented in training data.
Historical bias
Bias that arises when AI systems learn from historical data reflecting past discrimination, exclusion, or unequal social conditions.
Label bias
Bias introduced when labels or categories assigned to training data are inaccurate, inconsistent, culturally inappropriate, or shaped by structural inequity.
Target bias
Bias arising when the outcome a model is trained to predict reflects systemic constraints or inequities rather than the true outcome of interest.
Aggregation bias
Bias that occurs when a single model is applied to diverse groups without recognising important differences between them.
Evaluation bias
Bias arising when a model is tested using benchmarks, metrics, or datasets that do not represent the people or contexts in which it will be used.
Deployment bias
Bias that occurs when an AI system is used in a context, population, or manner different from that intended by its developers.
Emergent bias
Bias that appears when a model is used in unanticipated contexts or for purposes not considered during development.
Feedback loop bias
Bias that grows over time when an AI system’s outputs influence future data, reinforcing the same pattern. For example, a predictive policing system may send more patrols to already over-policed areas, generating further data that appears to justify the original decision.
Automation bias
The tendency for people to place too much trust in automated outputs and fail to question, check, or override them.
Disparate impact
A neutral policy, rule, or system that has a disproportionate adverse effect on a particular group, even if it does not explicitly treat that group differently.
Disparate treatment
Different treatment of people based on a protected or culturally significant characteristic.
Intersectional bias
Bias arising from the combined effect of multiple characteristics or identities, such as being Māori and disabled, or a wāhine Māori and a speaker of te reo Māori. It cannot always be detected by analysing one characteristic at a time.
Algorithmic lookism
Lookism
Preferential treatment or disadvantage based on physical appearance. In AI, lookism can arise in computer vision, facial analysis, recruitment tools, image generation, and systems that infer personality, competence, or emotion from appearance.
Algorithmic lookism
Systematic preferential treatment based on physical appearance that is embedded in or amplified by an AI system. It can affect image generation, facial analysis, hiring tools, beauty filters, recommendation systems, and automated assessments of people’s photos.
Appearance-based inference
The use of facial features, body shape, clothing, grooming, or other visual characteristics to infer traits such as competence, trustworthiness, emotion, sexuality, health, or criminality. These inferences are often unreliable and can reinforce harmful stereotypes.
Beauty bias
Preferential treatment based on perceived attractiveness or conformity to dominant beauty standards. In AI, it can influence image generation, recruitment, marketing, and social media visibility.
Facial recognition technology bias
Facial recognition technology (FRT)
A type of biometric technology designed to identify or verify an individual by analysing unique and measurable facial features.
FRT bias
Differential performance or error rates in facial recognition systems across demographic groups. FRT bias may arise from unrepresentative training images, poor image quality, algorithm design, or deployment conditions.
Demographic differential
A measurable difference in an FRT system’s performance or error rates across groups defined by characteristics such as skin tone, gender, age, or ethnicity.
False positive
In facial recognition, an incorrect match: the system wrongly reports that two images show the same person when they do not. False positives can lead to wrongful identification, surveillance, detention, or denial of services.
False negative
In facial recognition, a missed match: the system fails to recognise that two images show the same person. False negatives can prevent legitimate access to services or create verification failures.
False match rate
The frequency with which an FRT system incorrectly accepts a match between images of different people. It is also called the false positive rate.
False non-match rate
The frequency with which an FRT system incorrectly rejects a match between images of the same person. It is also called the false negative rate.
Demographic parity in FRT
The expectation that an FRT system should have comparable error rates across demographic groups. A system may have strong overall accuracy while still performing much worse for particular communities.
Training image diversity
The range of skin tones, ages, genders, facial features, lighting conditions, image qualities, and cultural contexts represented in the images used to train or test an FRT system. Limited diversity can contribute to demographic differentials.
Fairness measures
Fairness metric
A quantitative measure used to test whether an AI system produces equitable outcomes across groups.
Demographic parity
A fairness measure requiring similar positive outcomes across different demographic groups.
Equalised odds
A fairness measure requiring similar error rates across groups, including both false positives and false negatives.
Equality of opportunity
A fairness measure requiring similar access to favourable outcomes for people who genuinely qualify.
Calibration
A measure of whether a model’s predicted probabilities match actual outcomes. For example, a 70% risk score should correspond to a similar real-world outcome rate.
Group fairness
Fairness assessed by comparing outcomes or errors across defined groups.
Individual fairness
Fairness assessed by whether similar individuals receive similar treatment or outcomes.
Counterfactual fairness
A fairness test asking whether a decision would change if a person’s protected or culturally significant characteristic were different, while other relevant facts stayed the same.
Technical AI terms
Machine learning
A method of creating AI systems by training models to find patterns in data rather than programming every rule manually.
Training data
Data used to teach a model patterns, relationships, or tasks.
Test data
Data held back from training and used to assess how well a model performs.
Ground truth
The accepted reference standard used to judge whether an AI system’s output is correct.
Label
A tag or category attached to training data, such as “approved,” “high risk,” or “spam.”
Overfitting
When a model learns the details of its training data too closely and performs poorly on new data.
Underfitting
When a model is too simple to capture relevant patterns and performs poorly on both training and new data.
Accuracy
The proportion of predictions a model gets correct. Accuracy alone can be misleading when groups or outcomes are imbalanced.
Precision
Of the items a model identifies as positive, the proportion that are actually positive.
Recall
Of all the actual positive cases, the proportion the model correctly identifies.
Drift
A change over time in data, behaviour, or the environment that causes an AI model’s performance to decline.
Model monitoring
Ongoing checking of an AI system’s performance, fairness, security, and real-world impacts after deployment.
Model card
Standard documentation describing an AI model’s intended purpose, training data, performance, limitations, risks, and appropriate use.
System card
Documentation describing an AI system as a whole, including components, data flows, safeguards, intended users, and governance arrangements.
Generative AI
AI that creates new content, such as text, images, audio, video, code, or synthetic data.
AI agent
An AI system that can take actions toward a goal, often using tools, accessing systems, or completing multi-step tasks with limited ongoing human direction.
Automated decision-making
A decision made wholly or partly by a computer system without meaningful human judgement.
Hallucination
A confident but false, misleading, or unsupported output produced by a generative AI system.
Prompt injection
An attack or manipulation in which instructions hidden in content cause an AI system to ignore its intended rules or perform unintended actions.
Retrieval-augmented generation (RAG)
A method that connects a generative AI model to external knowledge sources so responses can be grounded in retrieved information.
Differential privacy
A mathematical approach that adds calibrated noise to query results or model training so that the presence or absence of any one person’s data is less likely to be revealed.
Federated learning
A privacy-preserving machine-learning approach in which models are trained across decentralised devices or servers without sharing the underlying raw data.
Data protection and security
Personal information
Information about an identifiable living individual, or information that can reasonably be used to identify them.
Privacy
The protection of personal information and people’s ability to control how information about them is collected, used, and shared.
Consent
A person’s informed, freely given agreement to a proposed use of their information. For Māori data, consent may also need to consider collective and intergenerational interests.
Data minimisation
Collecting and retaining only the data necessary for a clearly defined purpose.
Purpose limitation
Using data only for the purposes for which it was collected or for compatible purposes authorised by the data governance arrangements.
De-identification
Removing or altering direct identifiers so that a person cannot readily be identified.
Anonymisation
Processing intended to make it impossible to identify a person from data. True anonymisation is difficult to guarantee, especially when datasets can be combined.
Pseudonymisation
Replacing identifying details with codes or aliases. The data may still be re-identified if the key or additional information is available.
Re-identification risk
The possibility that supposedly anonymous data can be linked back to individuals or whānau through combinations of other information.
Data encryption
Encoding data so that only people or systems with the correct key can read it.
Access control
Rules and technologies that determine who can view, change, export, or delete data or systems.
Data breach
Unauthorised access to, disclosure of, loss of, or alteration of data.
Cybersecurity
Protecting systems, networks, and data from unauthorised access, disruption, modification, or destruction.
Frequently asked questions
What is Māori data sovereignty under Wai 2252?
Wai 2252 frames Māori data sovereignty as Māori data governance: the principles, structures, accountability mechanisms, legal instruments, and policies through which Māori exercise control over Māori data.
What is the difference between data sovereignty and data residency?
Data residency is where data is physically or legally stored or processed. Data sovereignty is broader: it concerns who has authority and control over the data, how it is governed, and which laws and cultural obligations apply.
Does storing Māori data in New Zealand achieve Māori data sovereignty?
No. Local storage can support Māori data sovereignty, but sovereignty also requires Māori governance, consent, tikanga-based safeguards, access controls, accountability, and meaningful Māori decision-making.
What is algorithmic lookism?
Algorithmic lookism is systematic preferential treatment based on physical appearance that is embedded in or amplified by an AI system.
What is FRT bias?
FRT bias is differential performance or error rates in facial recognition systems across demographic groups. It is commonly measured through false positive and false negative rates.
Related Taiuru & Associates resources
