I'm trying to set-up an access control system in CiviCRM to restrict access of certain users to certain custom data field sets. I'm planning to use Civi ACLs to achieve this, though my understanding is that they are overridden by Drupal permissions, and therefore the 'CiviCRM: access all custom data' checkbox must be unchecked within Drupal permissions. I will then be able to use ACLs to allow access to these fields to only the users I want.

My problem is that I've created a Drupal role 'crm user' with this box unchecked, but when I log in as a user with this role I can still see all the custom data, which I shouldn't be able to do. Does anyone know what I might be doing wrong? Are there any other Drupal permissions that need to be removed?