AggregateIQ (AIQ) was accused of processing people's data "for purposes which they would not have expected".
The firm has appealed against the notice, which was issued by the UK's Information Commissioner's Office.
AIQ is a small Canadian data firm that uses data to target online ads at voters during public polls.
It was paid nearly £2.7m ($3.6m) by Vote Leave to target ads at prospective voters during the Brexit referendum campaign.
It was also used by pro-Brexit youth group BeLeave.
AIQ also received funding from Northern Ireland's Democratic Unionist Party and Veterans for Britain, amounting to a total of £3.5m from all of its pro-Brexit clients.
...Earlier this year it was linked to UK data firm Cambridge Analytica by whistleblower Chris Wylie, who alleged that Cambridge Analytica improperly acquired Facebook data belonging to 50 million people via a third party.
Cambridge Analytica has been credited with helping Donald Trump win the US presidential election in 2016.
Mr Wylie told the Guardian newspaper in March that staff at the now defunct Cambridge Analytica referred to AIQ as "our Canadian office". AIQ rejects this description and says it is 100% Canadian-owned.