Are organizations the primary way to control access to datasets? Or are they the only way?

Does a dataset _have_ to belong to an organization, or can it belong to no org?