Biometric Identity Programme Series: Six Guides
Quick answer: This series covers the six decisions that decide whether a biometric identity programme works: how good the capture has to be, what reading a document chip requires, how duplicates are found and adjudicated, what the law allows a terminal to store, how the fleet is kept trustworthy, and how to write all of it into a tender. The parts stand alone, so start with the one you are stuck on. If you are specifying hardware now, read capture quality first and finish with the RFP.
Most guides about biometric hardware describe a device. This series describes a programme: what has to be true for enrolment, document checks, deduplication, data handling and fleet operations to keep working after the pilot ends.
Who this is written for
Procurement teams, project managers and engineers who have to make an identity programme work outside a demonstration room. That means people who have to write a specification, defend a threshold, explain a failure rate, or answer why a district stopped enrolling on a Tuesday.
It is not written as vendor marketing. Where a claim needs a source, the source is named: NFIQ 2.0 and ISO/IEC 29794-1 for capture quality, ICAO Doc 9303 for document chips, MOSIP's two-stage uniqueness check for deduplication, Article 9 GDPR and the DPDP Act 2023 for data protection. Where something could not be verified, it was left out rather than approximated.
The six parts
- Biometric Capture Quality: Why Enrolment Retries Happen
Why captures fail, what NFIQ 2.0 and ISO/IEC 29794-1 give you to specify a quality floor, and how platen size and operator feedback change the retry rate. - Reading eMRTD Chips on a Biometric Terminal
Passive Authentication, BAC, PACE, Chip Authentication and Terminal Authentication under ICAO Doc 9303, and the certificates each one demands from a terminal. - Biometric Deduplication at Population Scale
The demographic pre-filter, the ABIS 1:N search, the threshold policy, and the adjudication workload that programmes forget to budget for. - Biometric Data Protection: Consent and Retention
What Article 9 GDPR, India's DPDP Act 2023 and the EU wallet regulation mean for what a terminal may store, and for how long. - Managing a Fleet of Identity Terminals
Zero-touch enrolment, managed configuration, certificate renewal, version pinning and remote wipe for hundreds of units in the field. - Biometric Terminal RFP: The Specs That Matter
The eight specifications that decide an identity tender, and the acceptance test that makes them enforceable rather than decorative.
Which one to read first
Start from the problem you have, not from part one:
- Operators keep re-taking fingerprints → part 1, capture quality.
- You need to read passports or ID cards → part 2, document chips.
- The register has duplicates → part 3, deduplication.
- Legal or compliance review is blocking go-live → part 4, data protection.
- You already run terminals in the field → part 5, fleet management.
- You are writing the tender now → part 6, then go back to whichever part supplies the numbers you need.
What this series deliberately leaves out
Three things, so you know where the edges are. First, it does not compare ABIS or matching backends: we build capture devices, not matching engines, and a comparison written by a hardware supplier would not be trustworthy anyway. Second, it makes no certification claim on behalf of any build; where a certificate exists it is named, and where it does not, the article says so. Third, it contains no pricing, because a price without a configuration is not a price.
Everything else in the series is written to survive being checked.
Frequently asked questions
Do I have to read all six in order?
No. Each part answers one question and links to the others only where they genuinely add something. The order follows the life of a programme, so reading straight through gives you the full picture, but jumping to the part that matches your current problem is the intended use.
Is this specific to Xinhong hardware?
The specifications and standards in these guides apply to any supplier's equipment: NFIQ 2.0, ISO/IEC 29794-1, ICAO Doc 9303 and the data protection regimes are not vendor concepts. The parts that describe how we build and test devices are marked as such, and you can apply the rest to any tender.
Which standard should I cite for capture quality?
ISO/IEC 29794-1:2024 is the framework standard for biometric sample quality and defines how quality scores are meant to be stated. NFIQ 2.0 is the open implementation that turns a 500 ppi fingerprint image into a single number linked to recognition performance. Cite the standard for the requirement and NFIQ 2.0 for the measurement.
Does the series cover face recognition as well as fingerprints?
Capture quality, deduplication, data protection and fleet management apply to any modality. The parts that are modality-specific say so: document chips concern eMRTDs, and the capture quality part uses fingerprints as its worked example because that is where quality scores are best established.
Will more parts be added?
This page is the index, so any addition appears here. The six parts cover what programmes ask us about most often; if a question keeps coming up that none of them answers, it becomes part seven.
Tell Us Where Your Programme Is Stuck
Capture failures, document reading, duplicates, compliance review or a tender in draft. Tell us which, and we will point you at the part of this series that applies — and say plainly when it does not.