Ross and Brand both apologised for their behaviour
Ofcom has fined the BBC £150,000 over the lewd phone calls Jonathan Ross and Russell Brand made to actor Andrew Sachs on Radio 2 last year.
The media regulator said the fine reflected "the extraordinary nature and seriousness of the BBC's failures" and the "resulting breaches" of its code.
The BBC said it accepted Ofcom's findings and added that the material "should never have been broadcast".
Brand resigned over the affair and Ross was suspended for three months.
The fine relates to two episodes of the Russell Brand show broadcast on 18 and 25 October 2008.
Ofcom said the BBC broadcast explicit, intimate and confidential information about Georgina Baillie, the granddaughter of the Fawlty Towers actor, without obtaining consent either from her or Sachs.
"This not only unwarrantably and seriously infringed their privacy but was also gratuitously offensive, humiliating and demeaning," it said.
Ofcom fined the corporation £70,000 for breaching rules on generally accepted standards and offensive material.
It also imposed a £80,000 fine for failing to adhere to rules which protect members of the public from unwarranted infringements of privacy.
Ofcom has also directed Radio 2 to broadcast a summary of its findings.
The regulator noted that broadcasters should be allowed to enjoy creative freedom to explore issues and ideas "without undue interference".
"Creative risk is part of the BBC's public service role," it said. "However, so is the management of that risk."
Ofcom said it found in its investigation that despite Brand's show being considered to be "high risk" by the BBC prior to the incident, the broadcaster had ceded responsibility for managing some of that risk to people working for the presenter.
Ofcom's Stewart Purvis told the BBC the incident had come about because of "underlying flaws" in BBC systems.
Ross and Brand left messages about Sachs's granddaughter
"When the BBC decided to outsource this programme to an independent production company, it didn't put in place what we call compliance systems. In other words, ways of staying within the rules," he said.
"The executive producer of the programme was a senior figure in the agency which represented Russell Brand and a line producer was loaned by the BBC to the production company, of which Russell Brand is one of the owners."
There was therefore no one at the BBC who was "absolutely in editorial control of the whole process," he added.
Ofcom also noted in its report that Brand's interests "had been given greater priority than the BBC's responsibility to avoid unwarranted infringements of privacy, minimise the risk of harm and offence and to maintain generally accepted standards."
'Riddled with holes'
A BBC spokesman said: "As we said last October, this material should never have been broadcast and we apologised unreservedly for that.
"The BBC has since taken comprehensive action to deal with what were unacceptable failures in editorial judgement and compliance which led to the broadcast."
Chris Moyles's Radio 1 show has also been censured by Ofcom
Ofcom also raised concerns over the BBC's assurances that it was improving compliance.
The watchdog noted it had received similar assurances as recently as the summer of 2008, following its investigations into competitions and voting in BBC programmes.
"Ofcom therefore expects BBC management to ensure that these latest improvements are fulfilled effectively and quickly," it said.
Shadow Culture Secretary Jeremy Hunt said that while the fine itself was "relatively trivial", the incident represented a "huge" breach of trust for licence fee payers.
"It is clear from this damning report that the BBC's safeguards were riddled with holes," he said. "The public needs to know that this is never going to happen again."
In a related ruling, Ofcom found Chris Moyles's Radio 1 breakfast show breached broadcasting rules by allowing Brand to refer to Georgina Baillie during an appearance on the programme.
On the show, broadcast on 21 October, Brand said he had "in inverted commas, recently 'met'" a woman he described as "Andrew Sachs's granddaughter".
The comedian went on to laughingly claim he had "'met' her brains out".
Though Miss Baillie was not named in the programme, Ofcom found she was likely to be identifiable and that it had therefore infringed her privacy.