According to Article 4(1)(1) and Article 3 of the Personal Data Protection Act, personal data refer to any information relating to an identified or identifiable individual. Therefore, the enquirer's CV (including contact number, ID document number, etc.) is personal data, the processing of which is subject to the provisions of the Act. Pursuant to Article 6 of the same Act, in general, it requires the data subject's explicit consent for personal data processing to be legitimate. Therefore, to protect his personal data, the enquirer may ask the user of the email to delete the mis-sent CV. In case the enquirer finds mistaken illegally processing his personal data, he may lodge a complaint with the PDPB.