Distributing a phishing exercise to all employees is not advisable to do if your organization has a recurring issue with colleagues not reporting personal data breaches. A phishing exercise is a simulated attack that tests the awareness and response of employees to malicious emails that attempt to obtain sensitive information or compromise systems. While phishing exercises can be useful to train employees on how to recognize and avoid phishing attacks, they are not directly related to the issue of reporting personal data breaches. The other options are more appropriate to address the root cause of the issue, communicate the expectations and procedures for reporting breaches, and provide specific training to areas where breaches are happening1, 2. Reference: CIPM - International Association of Privacy Professionals, Free CIPM Study Guide - International Association of Privacy Professionals