Using Wordpress 5.4.1 with Civi 5.24.3.
We have a smart group used for ACL which prevents the core "Edit" button being shown on the contact summary.
There is also an ACL entry for a group of contacts to view/edit a custom data group.
However, contacts that are not in the ACL for the smart group are able to add and edit custom data (for all contacts, regardless of their ACL group).
How can I use ACLs to prevent a contact view and editing custom data for contacts who are not in their ACL group?
If I add the required ACL entry to give access to the custom data group, this allows them to edit ALL contacts' custom data, which seems contrary to the documentation.