CiviCRM Community Forums (archive)

I'm hoping for clarification on how to permission some forms correctly.

Our site has a membership sign-up form which allows people to enter some custom data about themselves. It also has other custom data tabs which we don't want visible to (all) users who have permission to view other contacts in the system.

In the Default Permissions and Roles page, it says

Access all custom data:
You must enable this permission for any role which you want to view or edit custom data fields. EXAMPLE: If your site uses Profile(s) which include custom fields, make sure the role(s) that need to access these Profiles have this permission. Be sure to assign this permission for the "anonymous" user role if you want to collect information using custom profiles with custom fields.

However, I believe it should be also possible to use CiviCRM ACLs to expose ONLY the profile I want to make available for new member signup, rather than giving anonymous user access to all custom data groups. Is that correct?