If your organization has a recurring issue with colleagues not reporting personal data breaches, all of the following are advisable to do EXCEPT?

The central issue is the failure of employees to report personal data breaches. Actions A, B, and C are direct and appropriate measures to address this problem. Reviewing reporting activity (A) helps identify root causes. Improving communication (B) and providing role-specific training (C) directly address potential knowledge gaps and reinforce the importance of the reporting process.

A phishing exercise (D) is primarily a tool to test and improve employees' ability to recognize and avoid a potential threat, thereby preventing a breach from occurring in the first place. While related to security, it does not directly address or solve the underlying cultural or procedural problem of employees failing to report a breach once they are aware it has happened.

A. This is incorrect because analyzing past reporting data is a critical diagnostic step to understand the root cause of under-reporting and to tailor effective solutions.

B. This is incorrect because reinforcing the reporting policy and procedure through clear communication is a fundamental step to ensure all employees understand their obligations.

C. This is incorrect because providing targeted training to high-risk groups is an efficient and effective way to improve awareness and compliance with reporting requirements.

1. Densmore

R. (2021). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). IAPP (International Association of Privacy Professionals).

In support of A

B

C: Chapter 7

"Monitoring and Responding to a Privacy Incident

" emphasizes the need for a continuous improvement loop. This includes post-incident analysis ("lessons learned") to refine the process (supports A)

and robust training and awareness programs to ensure employees know how and when to report incidents (supports B and C). The text states

"It is important to communicate the plan and ensure that everyone knows their role... Training should be tailored to the audience" (p. 203).

In support of D being the exception: While phishing is a common cause of breaches

the textbook discusses phishing tests as a component of security awareness training aimed at prevention

not as a primary tool to fix a broken reporting culture. The goal of a phishing test is to prevent the click

not to remediate a failure to report post-compromise.

2. Moulton

R.

& Coles

R. S. (2018). The Privacy Engineer's Manifesto: Getting from Policy to Code to QA to Value. Apress. https://doi.org/10.1007/978-1-4842-2875-7

Chapter 10

"Security Breach Management

" discusses the importance of creating a "no-blame culture" to encourage reporting. It highlights that "training and awareness are key" to ensure staff can "recognize a potential breach and know how to report it." This directly supports the advisability of communication (B) and training (C) to solve a reporting problem. A phishing test

by contrast

focuses on threat recognition

a separate (though related) skill.