The Information Commissioner’s Office is investigating Leave.EU and its donor Arron Banks over possible breaches of the Data Protection Act.

The ICO has issued “information notices” against both Leave.EU – the referendum campaign headed by Nigel Farage – and its director, Banks. The notices – requiring organisations to provide the ICO with specified information within a certain time period – were issued in the same week as the ICO conducted raids last month on Cambridge Analytica’s offices. The notices are both part of Operation Cederburg – the commissioner’s year-long investigation into the use of data in the EU referendum. Failure to comply is a criminal offence.

Banks – who was by far the biggest funder of Brexit, providing £8.4m in donations and loans – confirmed on Friday that both he personally and Leave.EU had received “information notices”. In an email on Friday, Banks said they were “responding to it’” He said the ICO’s action was not an “investigation” but “an information request”.

In a separate development, the Observer has obtained an invoice that Cambridge Analytica issued on 14 December 2015 for £41,500 for work it undertook on behalf of Ukip. The invoice says the payment is for “analysis of Ukip membership and survey data and creative product development”, and it is issued on behalf of Cambridge Analytica LLC, the American entity, from its office in Alexandria, Virginia. This is the first documentary evidence that Cambridge Analytica did conduct analytics work on behalf of one of the Leave campaigns in the period before the referendum.

Banks confirmed to the Observer that he was also sent the invoice at that time too. He said he subsequently made a donation for the amount to cover the invoice to Ukip. A spokesman for Ukip, speaking to the Guardian last month, denied any payment for the work was made but he confirmed Banks had in fact made the donation after “new information had come to light”. He said that the party decided not to pass on the money to Cambridge Analytica.

Banks has long denied that Cambridge Analytica did any work for Leave.EU, as has Cambridge Analytica. The question is still the subject of an ongoing investigation by the Electoral Commission. In a written submission to the select committee for the department for digital, culture, media and sport (DCMS) last month, Banks said he had met Alexander Nix of Cambridge Analytica but that he had declined to take him up on his proposal. Cambridge Analytica said on Saturday that it “did some preliminary analysis as part of a proposal to work with Ukip, but no contract was agreed, payment was not made to CA, and the preliminary work was not delivered to Ukip.”

Brittany Kaiser, a former Cambridge Analytica director, who appeared on a panel at Leave.EU’s launch event, came forward to the Guardian last month and raised further questions about these claims. She said the company had completed around £40,000 worth of work for Ukip, using Ukip data, but agreed that the company had not been paid. She is expected to talk about this on Tuesday when she will testify to parliament as part of the DCMS committee into fake news.

Ukip has confirmed it handed its database over to Cambridge Analytica. Photograph: Andy Rain/EPA

A Ukip spokesman told the Observer on Friday: “We got the money from Arron [Banks]. But we never paid it to Cambridge Analytica. We didn’t think it was worth it. It was preparatory work, a pitch.”

He also confirmed that the party had handed over its database of roughly 40,000 supporters to Cambridge Analytica despite denying this to the Guardian last month.

Ukip had told the Guardian previously that Cambridge Analytica “saw” the data but a spokesman admitted the information – including telephone numbers, email addresses, ages, and other personal information among other things – was given to the company on a computer as part of what he described as “preparatory work”.

The spokesman said: “I asked everyone about this work and I was told CA pitched for it, Banks didn’t like it and he’d refused to pay for it. It’s now come out that he did actually make a donation to cover the cost of the work. But we never actually handed it over.”

The revelations raise a whole new set of questions about how the referendum was funded and whether strict rules on spending may have been broken. The Observer has seen evidence which suggests that a form of the Ukip data that Cambridge Analytica analysed and processed was passed to individuals in the Leave.EU campaign. And a donation of £42,000 from Better for the Country, Leave.EU’s registered company name, was recorded as a political donation to the party on the Electoral Commission’s site one week before the referendum on 16 June 2016. It was not registered as part of the campaign by either entity as a referendum donation or expense.

The unfolding of the Cambridge Analytica scandal has coincided with the final stages of the information commissioner’s investigation into the use of data in the referendum. Leave.EU’s operation has become one focus of the year-long investigation. Another resulted in the ICO’s raid on Cambridge Analytica. Damian Collins, the Tory MP for Folkestone, who is the chair of the DCMS committee, has told the Observer that both Britain’s electoral and data laws needed a radical and urgent overhaul. He said it was “ridiculous” that the ICO had to wait five days before being able to get a warrant to seize Cambridge Analytica’s computer servers and equipment.

Separately, the ICO investigation is believed to be trying to understand the relationship between Leave.EU and Eldon Insurance Services, the Bristol-based insurance company that Banks owns and that was the HQ for Leave.EU referendum campaign work. A spokesman said: “Leave.EU and Eldon have never shared any data. And Leave.EU has never shared any data with Cambridge Analytica whether in relation to the EU referendum or otherwise.”

The ICO may be asking questions because of previous comments Banks has made, including in an interview a year ago with the Observer. When asked about the use of Leave.EU’s database to send advertisements about his insurance products to campaign supporters, Banks said: “Why shouldn’t I? It’s my data.” When asked again last week, he said: “Leave.EU after the referendum campaign carried the occasional ad for insurance, so what?”