We propose a model for biometric systems with a multiuser access structure, where after enrollment only predefined authorized sets of participants are allowed to access the system upon presenting their biometrics. Two types of system design are considered for the enrollment. In the first one, the participants must simultaneously present their biometrics to enroll in the system. In the second one, each participant can individually enroll in the system, which is more convenient for systems with a large number of participants. For these two types of enrollment and the presence of a multiuser access structure, the fundamental trade-off between security and privacy leakage is studied.