The Information Commissioner's Office is looking into claims that an 87-year-old man's personal details were sold or passed on by charities up to 200 times.
The Daily Mail reports that Samuel Rae, who has dementia, lost £35,000 after his information ended up with scammers.
Information was passed to charities after Mr Rae filled in a survey but did not tick a box stating that he did not want his personal details shared.
The Institute of Fundraising said its guidance on data would be reviewed.
Former army colonel Mr Rae is said to have been asked for money by charities more than 730 times after his data was repeatedly sold.
The Information Commissioner's Office is to consider whether any breaches of the law have taken place.
As well as selling, sharing and swapping details, the paper says some charities also passed them on to rogue firms responsible for scams and Mr Rae was later targeted by fraudsters.
Charities contacted him for up to five years after he had asked them to stop, with some requesting money as many as 38 times in a year.
Mr Rae is cared for by his son, who said he was horrified by how his father had been treated.
Steve Eckersley, of the Information Commissioner's Office, said the findings - presented after a Mail investigation using the Data Protection Act - were "clearly concerning".
He told the newspaper: "If charities are buying and selling personal information without any thought of the wishes of the people involved, it suggests not only a disregard for the law, but also a disconnect with the supporters whose generosity they rely on."
Daniel Fluskey, head of policy at the Institute of Fundraising, the professional body for UK fund-raising, told BBC Radio 4's World at One programme the majority of charities did not sell data.
He said the institute would be reviewing charities' practice of sharing and selling data, and expected to announce "a number of changes" to its code of practice.
He said: "We have to make sure that the code of practice that governs fundraising has the interest of the donor at the heart and meets their expectations of how charities fundraise."
Alistair McLean, chief executive of the Fundraising Standards Board, which regulates charity fundraising, told BBC Radio 5 live it was a "very, very serious case".
He said: "I feel that sometimes there's a little bit of poor practice that creeps in and that's just not acceptable.
"I would encourage members of the public who are unhappy about the way in which they've been approached by charities, unhappy about maybe the mail they've received, to complain."
Conservative MP Mark Garnier, a member of the Treasury Select Committee, said the "immense good will" people had for charities would "diminish" if the charity sector continued to sell or trade data.
He added that parliament also needed to look at the situation.
How to find out what information is held
- People have a legal right to find out what information an organisation has about them by making a subject access request.
- Organisations who receive a request are, in most cases, required to say what information they have, why they are using it and whether it will be passed on.
- They are also required to provide a copy of the records and to say where they got the information from.
- It is not possible to gain access to someone else's information unless you are acting on their behalf.
- There is a 40-day time limit for organisations to respond to the request, which needs to be made in writing and sometimes involves a fee.
- Some types of personal data are exempt from the request.
- For further information about making a subject access request, click here.
Dominic Nutt, who worked in PR for a number of charities, said in the last 10 years charities had adopted an "aggressive, business-like approach", with chief executives having performance targets like their counterparts in large companies.
He said: "Every conversation I used to have, and I was in media not fundraising, was around the numbers - it was the big thing.
He said those working in charities "genuinely believed" in what they were doing but marketing was "swallowing" their organisations.
In July, the government said it was changing legislation to help protect vulnerable people from aggressive fundraising and launched a review into the current system of self-regulation.
Charities are to be forced to draw up written agreements showing how vulnerable people will be protected from aggressive fundraising tactics, the prime minister said.
David Cameron said the actions of some fundraisers were damaging the reputation of the charity sector.