Boris Johnson, whose campaign to become the Conservative leader is facing the threat of an inquiry into its use of data, has sent an unsolicited email to his rival Jeremy Hunt seeking his support.

In another possible breach of data protection rules, the frontrunner to succeed Theresa May asked the foreign secretary to join his push to become prime minister.

Hunt’s team said on Wednesday he had not given permission to Johnson’s campaign to use his email address and believed it may be a breach of data laws.

The development follows the Guardian’s disclosure on Tuesday that Johnson’s campaign had been reported to the information watchdog for both emailing and phoning Tories without having permission to use their data.

According to official guidelines, any candidate wishing to send emails or texts or make automated calls “must ensure that they have consent from the individuals to use such marketing channels”.

Above a copy of a “Back Boris” email seeking his support, Hunt tweeted: “Well this is awkward ... definitely didn’t sign up to this mailing list.”

Well this is awkward... definitely didn’t sign up to this mailing list. pic.twitter.com/OhDiwPmIIe — Jeremy Hunt (@Jeremy_Hunt) July 3, 2019

The campaign email begins: “Jeremy. I’m writing today because you have supported my campaigns in the past by signing up to receive campaign updates or by volunteering to help.

“I’m now asking for your help again.”

The email includes a link via which Hunt can join Johnson’s leadership campaign and it asks Hunt to opt in to receive further updates and invitations.

“I’m asking for your support. Please click here to opt in to receive campaign updates or to volunteer,” it reads.

Harriett Baldwin, a minister, and Ben Howlett, a former MP for Bath, have complained to the information commissioner and to the Conservative party chair, Brandon Lewis, after receiving allegedly unsolicited requests for support from the Back Boris campaign. Both suspect it relied on email or phone number lists from previous campaigns to ask for support.

Baldwin wrote to the commissioner on Wednesday, claiming the Back Boris campaign had sent spam to her and her husband seeking permission to send them further correspondence.

A Johnson campaign source said it was compliant with both the British Data Protection Act and the EU’s tougher General Data Protection Regulation (GDPR), which came into force last year.

Howlett tweeted that he had received a random phone call from Johnson’s team. “Where did he get my data from given #GDPR and that I have never opted in or consented to my data being used – a complaint to the information commissioner @ICOnews is in order.”

In his complaint sent to the commissioner on Wednesday, Howlett said he had asked the Back Boris campaign how they obtained his telephone number but received no reply.

“I fear that my data has been illegally harvested and the Team Boris campaign may be in breach of data protection and GDPR laws,” he wrote.

Howlett, who chairs a campaign to improve the use of personal data, added that he had been contacted by “numerous Conservative party members concerned with email spamming and calls being made without registering their details”.

The Guardian has been shown four examples of Tory activists complaining about being contacted by Johnson’s campaign without permission. One wrote: “I have only given that particular email address to Conservative central office, which begs the question, are they using official party data?”

The Information Commissioner’s Office is assessing the complaints.

Johnson’s campaign has denied any wrongdoing.