LONDON — The defunct political consulting firm Cambridge Analytica violated British law when it used improperly harvested Facebook data to aid Donald J. Trump’s 2016 presidential campaign, and would face a significant fine if it were not already in bankruptcy, Britain’s top data protection watchdog found Tuesday.

The long-awaited report by Britain’s Information Commissioner’s Office, which has been investigating the misuse of personal data by political campaigns, also said an insurance company owned by Arron Banks, a main backer of Britain’s campaign to leave the European Union, broke British law when it used customer data to aid the Brexit effort.

According to the commissioner’s office, the company, Eldon Insurance, shared private email addresses to be sent campaign messages on behalf of Leave.EU, a pro-Brexit group, months before the 2016 referendum on Britain’s membership in the European Union.

The 112-page report underscored how modern political campaigns rely on Facebook data and other consumer information, extracted or bought by consulting firms with little oversight and few protections for consumers. An investigation in March by The New York Times, The Observer of London and The Guardian revealed how Cambridge Analytica — at the time an upstart data firm bankrolled by the conservative billionaire Robert Mercer — had improperly obtained and exploited Facebook data from as many as 87 million users around the globe.