Potential nuisance callers and scammers could be able to buy sensitive personal and financial information for as little as 4p a record, a watchdog has warned.
An undercover Which? Money team investigating 14 data-selling companies found "numerous" examples of irresponsible behaviour and were able to discuss buying personal information for more than half a million people aged 50 and over, including salary, pensions, homes and jobs.
One company issued an invoice for nearly 500,000 pieces of personal information on households with an income of £40,000 and over, including phone numbers and addresses, at just 4p each.
Another firm issued an invoice for 2,200 names and numbers of people with a household income of £35,000 and over at 66p per item.
No personal data was exchanged during the investigation except for one company that sent a sample telephone list on which 13 out of 18 people were registered with the Telephone Preference Service (TPS), the opt-out register to avoid receiving unsolicited marketing calls.
Which? said basic research by the firms involved would have revealed that the watchdog's fake business was not listed at Companies House, FCA regulated or registered with the Information Commissioner's Office (ICO).
Four firms demonstrated what Which? believed to be best practice by refusing to deal with the fake pensions company from the outset. The other 10 firms still failed to carry out due diligence up to the point where orders were being placed. Which? stopped short of buying any data.
Which? said many companies appeared to be in breach of the ICO's guidance on the consent consumers give to have their details shared, which should be "knowingly and freely given, clear and specific".
Which? Money editor Harry Rose said: "Our investigation highlights that sensitive personal and financial data is being traded on a huge scale, with some companies apparently willing to sell to anyone who comes calling.
"Millions are already pestered by nuisance callers and targeted by scammers. To avoid ending up on a list, never give permission for your data to be shared by third parties and if you are called out of the blue about a financial opportunity, hang up and report it to the regulator."
An ICO spokeswoman said: "The findings from Which? are very concerning and appear to raise serious issues about the compliance of organisations with data protection law. People have the right to know what happens with their personal data and be given a choice about how their details are used.
"We will be investigating these findings as they may provide a new line of inquiry to our ongoing work looking at the buying and selling of personal data. Where we have found companies have not followed the law, we will consider enforcement action."