In M3.6 a new bulk user action was made available to download the participants list in various formats see
I'm not sure that our DPO would be too keen that this action is available to everyone who can view the participants list. i.e. We don't want various versions of spreadsheets being downloaded with personal data.
Would it be possible to have a capability check before giving these options? e.g. "Download participants list"