There are a couple of posts, listed below, already on this topic - but I'd like to follow up:
I can create an ACL role and limit access to a custom field group - which is seemingly wonderful. Data that should not be visible to everyone is not.
BUUUT any user (with the ability to edit a contact) can add users to an ACL group. I feel it renders ACL roles/restrictions pointless. (We have users who need to be able to edit a contact, to adjust contact information and such but shouldn't be privy to all the custom data in the system.)
QUESTION Does anyone have feedback on the Group Protect extension? It looks very promising but the notes indicate it's a work in progress from early 2016. Or is anyone taking a different avenue to prevent users from adding themselves to ACL groups?