Kent Police has been fined £80,000 after it handed data on a phone belonging to an alleged domestic abuse victim to her partner's solicitor.
The Information Commissioner's Office (ICO) said it was a serious breach of the Data Protection Act.
The woman gave her phone to Kent Police because she said video footage backed her claims against her partner, but the phone also contained sensitive data.
Kent Police said procedures had been changed to avoid errors in the future.
ICO head of enforcement Stephen Eckersley said: "Kent Police was investigating a serious matter yet the need to take proper care of the personal details they were entrusted with does not appear to have been taken seriously."
He said the force handed the solicitor "the entire contents of the complainant's mobile phone".
It contained many other files, with sensitive personal data including text messages and family photographs.
The woman's partner was a police officer who was subject to a professional standards investigation by Kent Police into misconduct.
According to Kent Police, the unnamed officer was facing a criminal investigation over alleged domestic abuse and was then also investigated for misconduct following a breach of his bail conditions after his arrest.
The ICO said the data on the phone was sent by mistake in advance of the misconduct hearing, and the solicitor disclosed the information to his client.
An investigation by the ICO found Kent Police had inappropriate security measures and it had committed a serious breach of the law, likely to have caused "substantial distress".
In a statement, Kent Police said it accepted the ICO's decision.
The force said: "When the data breach became apparent Kent Police referred itself to the Information Commissioner and fully cooperated with the investigation.
"As soon as the breach was identified a new standard operating procedure was implemented to ensure that a similar error cannot be made in the future."