I'm a little confused on how custom data ACLs work - specifically, when I give a role access to edit a set of custom data fields that are associated with a contact, like so:


Does this allow that role to edit the custom data belonging to any contact or just their own contact?

If it would allow that role to edit custom data belonging to any contact, how can I lock it down so they can only edit their own data?

My use case is this: I want users to be able to log into the site, update their own information, and only their their own. Nobody else's. Their information is in a profile and custom fields.

  • Can you say a bit more about your use case? Should contacts other than their own contact be editable at all? If it's just the custom data you want to lock down you'll need some custom code. If it's acceptable to lock down the contacts generally you're likely in luck. Jan 23, 2019 at 20:10
  • ACL's are complex - it's worth setting up a test and verifying that the behaviour you observe is what you what.
    – Aidan
    Jan 24, 2019 at 13:58
  • agree with Jon, it helps if you expain what outcome you are after as you may be barking up the wrong tree eg compared to using a checksum to direct folk to a Profile edit screen
    – petednz - fuzion
    Jan 24, 2019 at 19:24
  • Updated with my use case. Sorry for the lack of clarity!
    – Dave
    Jan 24, 2019 at 21:03
  • CiviCRM has two permission models - there are ACLs and CMS permissions. You don't need ACLs to accomplish what you're trying to accomplish. Use Thomas' CMS suggestion and you should be done. Jan 24, 2019 at 21:05

1 Answer 1


This will allow to view/edit a custom data field set for every contact the user has view/edit permissions.

Despite the option named Edit there is currently no difference to View, as descibed in the note. Whether you can actually edit it depends on the ability to edit the contact.

There is a CMS-based permission CiviCRM: edit my contact to edit your own contact.

  • This is the key I needed, thank you! So as long as "edit my contact" is enabled and not "edit all contacts," this ACL will only allow them to edit data associated with their own contact record. Makes perfect sense. Have a checkmark.
    – Dave
    Jan 24, 2019 at 21:04
  • so you are using both the CMS permission and the Profile ACL?
    – petednz - fuzion
    Jan 25, 2019 at 2:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.