But he told delegates at the DMA's Annual Legal Conference that both government and business had "come a long way" in terms of understanding data protection since Thomas took office in 2002.
Data protection has a far higher profile now, Thomas said, thanks to the much-publicised losses of data, technological advances and globalisation.
"There have been 401 breaches in the past since November 2007. It's not a happy story and not by any means the full story. It has caught the popular imagination and people don't want to suffer the risks of identity theft and their details getting into the wrong hands."
The ability of companies and organisations to protect data is seen by consumers "as a reputational issue," with 95% of the public in one survey supporting the need for data protection legislation. "We've noticed a shift in media attitudes [too]," Thomas added. "We always expected the Guardian [to cover data privacy issues] but now we're seeing coverage in the Daily Mail."