Confidential and personal details were sent to the wrong people by staff at Companies House in Cardiff, BBC Wales has learned.
A Freedom of Information request revealed 13 breaches of data protection law at the agency's headquarters in 2014.
A director's home address was revealed on the public register following a "mix-up" of documents being scanned.
Case correspondence was also mistakenly scanned onto the register.
A new personnel system also allowed staff access to information on the duration of colleagues' sickness absences.
Companies House, which currently employs 904 people in Cardiff and registers the information companies are legally required to supply, said it had "an incident process in place that all staff adhere to" when a breach of data protection law happens.