A survey of FTSE 100 companies by marketing consultancy Marketing Improvement, revealed that just four per cent were able to comply with the Data Protection Act.
Most companies follow notification rules laid down by the Information Commissioner, but some are not meeting all recommended procedures. Four per cent of the FTSE 100 are breaking data protection regulations.
"I think this is a problem because the rights of individuals are being eroded," said Tim Trent, data privacy consultant at Marketing Improvement.
"The Information Commissioner has to start taking the law very seriously and needs to start enforcing it.
"I appreciate the stance on education first and enforcement next, but we have got to the stage where education should have finished and enforcement should have started."
The Information Commissioner believes companies are making good progress and a heavy-handed enforcement policy would damage data protection in the future.
"Sometimes organisations find data protection a bit complicated to understand and we have a study at the moment to make data protection simpler," said Commissioner Jonathan Bamford.
"So many people speak to us about what they want to do and seek our advice. If they thought we would be running around kicking the door down if they were doing something, they wouldn't speak to us and that is more damaging in the long term."
Companies with consumer facing operations are more aware of their obligations than business-to-business firms, said Simon Stokes, head of e-commerce, at law firm Tarlo Lyons.
"I'm sure the B2B organisations aren't dotting the Is and crossing the Ts on all aspects of data protection, because the risk just isn't the same as it is with consumers," he said.
All Library issues