The regulator said it will now audit the data protection practices at both companies, looking at how personal data is processed, reviewing what policies are in place and interviewing key employees within the organisations, as part of its ongoing investigation into the use of data analytics for political purposes.

The ICO announced its intention to fine the companies in November after finding that the campaign group and Arron Banks’ insurance company were closely linked. Leave.EU has been fined £15,000 by the watchdog for using insurance customers’ details to send almost 300,000 political marketing messages.

In another breach, in which one million marketing emails were sent to Leave.EU subscribers without sufficient consent, Leave.EU has been fined £45,000 and Eldon Insurance has been fined £60,000.

Two assessment notices have been sent to the companies to inform them that their general data practices will be reviewed. These notices allow the ICO to access Leave.EU and Eldon’s joint offices, staff and documentation.

Elizabeth Denham, information commissioner, said: “It is deeply concerning that sensitive personal data gathered for political purposes was later used for insurance purposes; and vice versa. It should never have happened.

“We have been told both organisations have made improvements and learned from these events. But the ICO will now audit the organisations to determine how they are using customers’ personal information.”