I’d say both things go hand in hand.
Individual change is definitely easier to achieve, but even getting a certain idea out to let the individuals protect themselves on their own is difficult, privacy isn’t really easy to sell because, beside a basic level, most people don’t care about it or assume it’s unattainable.
So yes both are difficult in their own way, but the effect that policies have when they’re finally applied is more powerful and protects everyone by default, even without them knowing, e.g the GDPR