There are a couple of posts, listed below, already on this topic - but I'd like to follow up:
SUMMARY
I can create an ACL role and limit access to a custom field group - which is seemingly wonderful. Data that should not be visible to everyone is not.
BUUUT any user (with the ability to edit a contact) can add users to an ACL group. I feel it renders ACL roles/restrictions pointless. (We have users who need to be able to edit a contact, to adjust contact information and such but shouldn't be privy to all the custom data in the system.)
How do I prevent a user from adding contacts to ACL groups?
QUESTION Does anyone have feedback on the Group Protect extension? It looks very promising but the notes indicate it's a work in progress from early 2016. Or is anyone taking a different avenue to prevent users from adding themselves to ACL groups?