Which of the following should an organization do FIRST to mitigate the risk of employees mishandling personal data?

Awareness training is the foundational first step because human error and mishandling are the primary causes of personal data incidents. Training educates employees on what constitutes personal data, regulatory obligations, and proper handling procedures. Without this foundational knowledge, technical controls alone cannot prevent employees from mishandling data they do not recognize as sensitive.

Encryption protects data confidentiality in storage and transit but does not address the human behavior that leads to mishandling such as improper sharing or unauthorized disclosure.

Data classification levels are a necessary control, but employees must first understand why classification matters through awareness training before classification policies can be effectively applied.

A DLP tool is a technical control that complements human behavior but cannot prevent all forms of mishandling such as verbal disclosure or physical document exposure, and is less effective without trained employees.