RE: AcL is not working on local user nsf file (Lotus domino 8.5.3) Harkpabst Meliantrop 3.Aug.18 12:39 PM a Web browser Domino Server All ReleasesAll Platforms
And as Mark already pointed out: ACLs never work on databases accessed locally from the Notes client, UNLESS the option "Enforce consistent ACL" is set. This is by very design and neither a problem nor a security hole.
If you as a system administrator are copying mail files on the OS level for backup purposes, it is your responsibility that only entitled persons have access to the backup location.