Elizabeth Denham was giving evidence to a parliamentary inquiry into fake news.
She said she was "astounded" by the amount of data held by companies such as Facebook, Cambridge Analytica, data brokers and political parties.
She also added weight to calls for Mark Zuckerberg to appear before MPs.
She stopped short of saying that he should come to the UK to answer questions posed by the Department for Digital, Culture, Media and Sport (DCMS) select committee's inquiry, something which has been demanded by MPs.
But she did say that, in her investigation into Facebook's role, it was "critical" that she had direct access to executives based in the social media's new Mountain View offices.
It would be "very useful" for Mr Zuckerberg to talk directly to MPs, she said.
The Information Commissioner's Office (ICO) investigation into how the data of millions of Facebook users was harvested by an academic and shared with Cambridge Analytica was, she told MPs, "unprecedented", in terms of scale, cost and complexity.
In October, the ICO fined Facebook the maximum of £500,000, over its involvement in the controversy.
Ms Denham told MPs that Facebook needed "to significantly change its business practices".
"There is a fundamental tension between its business model and the protection of the privacy of users' data," she said.
She also spoke about how she felt a new regulatory model was needed to deal with online misinformation and harmful and offensive user-generated content - one that was tougher on tech firms.
"The time for self-regulation is over. That ship has sailed," she said.
She said that parliament needed to set the objectives, with a code of practice being drawn up by a hybrid regulator, combining the skills of Ofcom and the ICO.
"No country has tried this yet. It's quite controversial and the need to balance freedom of expression with the harms of the internet is hard," she told MPs.
She also said that there needed to be an "ethical pause" to consider how political marketing should be conducted online in future.