Experts insist on stronger protective measures for Mexico’s biometric CURP

Despite warnings from cybersecurity experts of centralizing sensitive biometric and biographic data, the government of Mexico is moving forward with its plans to implement the mandatory use of the Clave Única de Registro de Población (CURP) as its national identification document beginning in January 2026.

Mexico Business reports that the country suffered 324 billion cyberattack attempts in 2024, and more than 40 billion in the first three months of this year already. These figures, according to experts, demonstrate the need for robust cybersecurity measures for the new biometric identification system.

The biometric CURP is built on a centralized data repository, which experts say, makes the impact of a successful cyberattack potentially devastating.

Cybersecurity specialist Ricardo Darling is quoted as cautioning that “the government must implement security elements that allow data to be stored securely and reliably and that maintain the due confidentiality and integrity within the database.”

The biometric CURP is an upgraded version of the personal identification system which has existed in the country for many years. The biometric digital ID system, the government says, is intended to strengthen personal identification, prevent identity fraud and also help in addressing the problem of missing person identification.

As part of efforts to strengthen the security of the CURP, the government recently announced the integration of the biometric population registry system with a secure digital ID authentication provider Llave MX. The integration means that Llave MX’s secure platform will be used as an authentication gateway to verify who individuals claim they are

Issuance of the biometric CURP was paused by court orders in some states following petitions over data privacy concerns.

Oaxaca state to use biometric CURP for social protection

Meanwhile, as part of efforts to drive adoption of the biometric CURP, the National Population Registry (RENAPO) has signed a coordination agreement with the State of Oaxaca for the identifier to be used for social development programs.

Per the agreement, the biometric CURP will be used to ensure accurate identification of beneficiaries in Oaxaca’s social programs, facilitate data exchange and validation between Oaxaca’s welfare systems and RENAPO’s CURP database, and improve transparency, efficiency, and equity in the management of the state’s social programs.

The new agreement replaces a previous one which was signed in 2018, and aligns with Oaxaca’s State Development Plan 2022–2028 which aims to reduce poverty and social exclusion through better data integration and targeted programs.

Delivery of the digital version of the biometric CURP is set to kick off on October 16 and the rollout shall unfold progressively across the country as individuals and organizations are being called upon to embrace the new dispensation.

Officials say the biometric ID will become mandatory by February next year, time by which all the necessary infrastructure would have been put in place.

Already, the biometric CURP can be obtained at 145 physical offices of the National Population Registry, Infobae reports. Citizens can submit their application either physically or online via Llave MX, a digital ID platform which was recently linked to the biometric CURP.

Authorities explain that those who have their biometrics with either the election or tax services can complete their application entirely online by allowing consent to such data for validation.

Minors are also expected to have the biometric CURP and the government says parents have up to November 13 to integrate their biometric data into the National Population Registry.

Article Topics

biometric identification  |  biometrics  |  civil registration  |  Clave Única de Registro de Población (CURP)  |  cybersecurity  |  digital ID  |  government services  |  Mexico  |  National Population Registry (RENAPO)