The Cambridge Analytica scandal was a “serious breach” of data protection laws, UK regulator says.