WhichT5f the following is the MOST effective way to promote organization-wide awareness of data security in response to an increase in regulatory penalties for data leakage?

Enforcing sanctions is a reactive measure for noncompliance, not a proactive way to build awareness and prevent issues initially.

Phishing simulations are valuable for identifying vulnerabilities to social engineering attacks but do not provide comprehensive awareness across all aspects of data handling and policy compliance.

Mandatory training on data handling policies directly educates all employees about their responsibilities regarding data protection, the specific policies to follow, and the consequences of non-compliance, thereby directly addressing the cause of potential data leakage and compliance with regulations.

Testing the data breach response plan is crucial for preparedness *after* a breach but does not primarily serve to promote organization-wide *awareness* of data security practices to prevent breaches.