State bodies have been warned of a crackdown unless they overhaul the way they treat personal data.