Who can do this: anyone who can edit the list.
Decide whether clients can download candidate profiles and files, or only read them in the browser.
Steps
Open the list and click List configuration > General.
Under Allow clients to download candidate files, choose:
Yes, allow downloading candidate files: clients see Download as PDF on profiles and can download CVs and uploaded files.
No, only allow viewing files in the web browser: the download button is gone.
The change saves straight away ("Shared list has been updated").
Good to know
This covers the profile PDF, the CV/resume and files in custom fields.
Anything a client can see on screen, they can still copy or screenshot. For sensitive details, hide them with candidate data control instead.