The ICO investigated the companies following separate complaints.
The Littlewoods investigation was triggered by the company continuing to send a customer marketing material, despite her attempt to stop it using her personal data for direct marketing purposes.
The ICO ruled that Littlewoods had failed to process customer data in accordance with the Act.
The Orange complaint centred on the way in which new members of staff were allowed to share usernames and passwords when accessing the company IT system.
The ICO decided that Orange was not keeping its customers' personal information secure and was therefore in breach of the Act.
It has required both companies to sign a formal undertaking to comply with the principles of the Data Protection Act. It said failure to meet the conditions of the undertaking is likely to lead to further enforcement action by the ICO and could result in prosecution by the data protection watchdog.
Last month, the information commissioner called on the government to grant stronger powers to allow his office to carry out inspections and audits to ensure organisations are complying with the Data Protection Act. Currently, the commissioner must gain consent before inspecting an organisation for compliance.