A failure by the Better Together movement to register its operation in advance with the UK Information Commissioner's Office (ICO) has also exposed its directors, including former Labour chancellor Alistair Darling, to a theoretical risk of prosecution.
The SNP said the revelations raised questions about the basic competence of the pro-Union forces. Last week Better Together had to withdraw one of its leaflets after using the BBC logo without permission, and recently bungled the launch of its first national campaign day.
Although Better Together would be taken to court only if it persisted in flouting data law, the ICO confirmed the group had technically committed a criminal offence through its negligence.
An ICO spokesman said: "It may be sloppy paperwork but it's still a criminal offence."
The SNP last night claimed Better Together's credibility had been shattered and urged it to destroy the "dodgy database" of supporters it has unlawfully accumulated.
Under the 1998 Data Protection Act (DPA), all large organisations processing people's personal data must notify the ICO prior to handling the information. Failure to do so is an automatic offence.
Yes Scotland Ltd, the campaign for independence, registered the day before its launch on May 25, and is now authorised to hold and process personal data for fundraising and "canvassing political support among the electorate".
Scottish Labour, the Scottish Tories and the Liberal Democrats, the parties behind Better Together, are also registered with the ICO for the same reasons, but they failed to register before gathering the data on supportive voters on its launch on June 25.
Despite this, its website said: "The information you supply us will be treated in confidence in accordance with the Data Protection Act."
The ICO told the Sunday Herald that it was not until July 30, five weeks after its launch, that Better Together (2012) Ltd requested notification forms.
The ICO also insisted that Better Together had failed to react to two "chaser" letters, and that as such was not officially registered as a data controller, as required by law.
Better Together last night said it felt sure the forms had been returned in August, but could not say definitively until next week.
An ICO spokesman said: "It's a criminal offence not to notify the ICO. They [Better Together] contacted us on July 30, confirming they needed to notify. They were sent out a pack. They need to fill in those forms and get them back to us as soon as possible. It's a criminal offence. They should have notified. They haven't done so so far."
The DPA says if a breach of the law is "attributable to any neglect on the part of any director, manager, secretary or similar officer ... [he] shall be guilty of that offence and be liable to be ... punished accordingly."
Better Together 2012 Ltd's directors are Darling, Tory MSP David McLetchie, Labour MSPs Jackie Baillie and Richard Baker, and Scottish Liberal Democrat, convener Craig Harrow.
An SNP spokesperson said: "This is a serious blow to the credibility of the No campaign, from which it will struggle to recover. Whether due to staggering complacency or incompetence it has been engaged in illegal activity.
"The board members bear personal responsibility for the campaign's failure to comply with data protection law.
"If Better Together cannot run a campaign without breaking the law, why on earth should anyone take them seriously on the issue of Scotland's constitutional future?
"Mr Darling must make an immediate statement confirming that the No campaign will destroy the data which it has been unlawfully gathering over the past few months."
Better Together said: "It is our understanding that we have completed the registration process with the ICO. We will be contacting the Information Commissioner as a matter of urgency to discuss why there appears to be this issue.
"We would like to assure everyone who has registered their support with us that their information has been handled in strict accordance with the law."
'It may be sloppy paperwork but it's still a criminal offence'