An investigation has been launched into claims the details of millions of people's pensions are being sold to fraudsters and cold-calling firms.
Firms are selling data about people's salaries, investment values and pension size for as little as 5p without their knowledge, the Daily Mail said.
It is feared it will be used to scam pensioners who can access their full pension pots under new rules in April.
Information Commissioner Christopher Graham said he was investigating.
He told the BBC that the claims were "very serious" and said he was in touch with the Pensions Regulator, the Financial Conduct Authority and the police.
"There are lots of people out there who are trying to take advantage of leads that they get to sell you stuff," he said.
However, at least one of the firms accused of selling data has denied doing anything illegal.
Pension changes 2015
- People aged 55 and over can withdraw any amount from a Defined Contribution (DC) scheme, subject to income tax
- Tax changes make it easier to pass pension savings on to descendants
- Many people with Defined Benefits (DB) schemes will be allowed to transfer to DC plans
- All retirees will have access to free guidance from the government's Pension Wise service
- Existing annuity holders unaffected for the time being
The Daily Mail said its undercover reporters were able to buy pension details by claiming they were from a cold-calling company.
However, one of the companies that offered information to the reporters - B2C Data - denied selling "highly sensitive details of salaries, investments and pensions".
It said its data business was "entirely legitimate and legally compliant".
"Importantly, it does not receive or process information other than in respect of those customers of its members who have opted in," said a B2C spokesperson.
Previously B2C told the paper that it gathered some details from mortgage application forms.
Mortgage applicants have to give details of their savings, and may not always tick a box to stop their data being passed on.
Another suggestion being made is that people give away information unwittingly when filling in forms for savings products such as Individual Savings Accounts (Isas).
Analysis: Brian Milligan, personal finance reporter
About 300,000 people are expected to be able to take immediate advantage of changes in pension rules on 6 April, and the industry has repeatedly warned about the dangers of scams.
The Association of British Insurers, which represents many of the big pension companies, is among those who have already called for a tightening of the rules.
But the real question is: How are these data firms obtaining personal details of salaries and pensions in the first place? Pension companies themselves naturally deny selling information.
However, it is not necessarily illegal to sell data lists, when people have given away information freely.
Steve Webb - pensions minister in the coalition government - has already admitted there will be a lot of crooks wanting to take advantage of the pension reforms, and has advised people to take professional advice.
A second company - Targeted Response Direct (TRD) - denied the Mail's accusations of selling unregulated high-risk investments to pensioners.
"For the record, we don't sell pension details," said David Billington of TRD.
"We do not target pensioners for any investment product or service," he said.
The Association of British Insurers (ABI) advised people to be on their guard against unsolicited approaches from financial companies.
The ICO has the power to issue fines of up to £500,000 for the most serious breaches and can pursue criminal prosecutions around unlawfully obtaining or accessing personal data.