Application of Information Technology in Business

Business now runs on computers and the internet. Customers order online, banks move money in seconds, and records are kept on servers and phones. That creates new opportunities and new legal problems: when is an online contract formed, who protects customers’ personal data, what is a crime in cyberspace, and how can electronic evidence be used in court?

The syllabus answers these in one chapter, supported by the earlier topics on contracts, electronic evidence and money laundering. This last topic of the course brings them together.

This topic covers e-commerce and the law of electronic transactions, the Cybercrimes Act 2015 as amended in 2024 with its offences and penalties, electronic fraud and the ways it is committed, data protection (the National Information Technology Development Agency (NITDA) regulation, the Nigeria Data Protection Act 2023 and the 2025 General Application and Implementation Directive), virtual evidence and virtual hearings, and the storage devices used to keep data and evidence.

E-commerce and the law of electronic transactions

E-commerce is the general conduct of business on the internet. The world wide web, or cyberspace, offers websites and online shops through which organisations and individuals complete many kinds of transactions with far-reaching legal consequences, including breaches. Parties to online transactions may find it hard to prove their rights, because the legal boundaries on the internet are blurred. Jurisdiction is hard to establish without new laws on electronic transactions.

When does an online dealing become a contract?

Under common law, offer and acceptance are clearly marked and the methods of acceptance are known. Internet shops and malls are non-physical, and so are their displays, so it is difficult to tell the real offer and acceptance apart. The general law on acceptance applies, with some inhibitions. An offer communicated by email and received does not itself make an acceptance.

A reply saying that the offeree will communicate acceptance in due course is not an acceptance either. The topic on e-contracts covers the formation of online contracts, the three types (click-through, shrink-wrap and browse-wrap) and jurisdiction.

Awareness and crime

Many people fall victim to breaches without knowing their remedies. Cyberspace is full of fraud and criminal activity: social engineering, virus infections, blended attacks, ransomware, cyberstalking, hacktivism and cyberwarfare by aggressive nations. Policing and enforcing these rights needs regulation and rules of jurisdiction.

Laws in the United States, for comparison

• The Computer Fraud and Abuse Act (18 U.S.C. s1030) is the primary United States (US) law, giving criminal and civil redress. It forbids unauthorised access to a computer, obtaining national security information, accessing computers used in interstate or foreign commerce, or non-public US government computers, or knowingly and fraudulently accessing a secured computer without authority. It also forbids threats of extortion and cyber-extortion.
• The Electronic Communications Protection Act protects electronic communications and their contents in transit.
• Other laws forbid denial-of-service attacks, phishing, identity theft and electronic theft, and the possession or use of tools to commit cybercrime.

E-commerce in Nigeria

Nigeria has embraced emerging technologies and e-commerce. Online shops such as Konga, Jiji, Jumia, PayPorte, VConnect and Kara trade in groceries, household goods, office equipment and even real estate. Card companies (MasterCard, VISA, Verve) and switching companies (eTransact, Interswitch) make electronic payments possible in seconds. The legal consequences include:

1. the validity of online purchase contracts;
2. addressing payment defaults;
3. data privacy violations; and
4. the incursion of online criminals.

In response, the government enacted its first cybercrime law in 2015, and data privacy protection was boosted in 2019 by the first regulation on data protection, issued by the National Information Technology Development Agency (NITDA).

The Cybercrimes Act 2015, as amended in 2024

The Cybercrimes (Prohibition, Prevention, Etc.) Act 2015, as amended by the Cybercrimes (Prohibition, Prevention, Etc.) (Amendment) Act 2024, is a unified law like the US code. It provides for the prohibition, prevention, detection, prosecution and punishment of offenders in the Nigerian cyberspace, and protects:

1. the national information infrastructure;
2. the promotion of cybersecurity;
3. computers;
4. communication networks;
5. data; and
6. intellectual property rights.

Section A of November 2016 included “cyber-crime” among the options in a question on the use of computer-based terms.

Offences and penalties (summary table in the syllabus)

Key provisions in the syllabus’s list for the 2024 Act

The syllabus gives a second list, which describes the 2024 Act as follows:

• Identity theft: up to 7 years, or a fine of ₦5 million, or both (section 22(1)).
• Offences against critical national infrastructure designated by the President: up to 10 years with no option of a fine, or 15 years if grievous bodily harm results (section 5).
• Unlawful and intentional access or hacking, including internet fraud: a fine up to ₦5 million, or up to 5 years, or both (section 6).
• Obtaining computer data, programmes, commercial or industrial secrets or classified information without authority: up to 7 years, or a fine up to ₦7 million, or both.
• Hindering the functioning of a computer system by inputting, transmitting, damaging, deleting, altering or suppressing data: up to 2 years, or a fine up to ₦5 million, or both (section 8).
• Phishing, obtaining usernames, passwords or card details by pretending to be a trustworthy entity: 3 years, or ₦1 million, or both (section 32).
• Deliberate and malicious spreading of viruses or malware (ransomware, spyware, worms, trojans) that damage critical information of public, private or financial institutions: 3 years, or ₦1 million, or both (section 32).
• Selling or distributing tools used to commit cybercrime: up to 3 years, or a fine up to ₦7 million, or both (section 28(1)).
• Cyberstalking and cyberbullying: up to 3 years, or a fine up to ₦7 million, or both (section 24).
• Cybersquatting, registering or using a domain name or word that is another’s registered business name or trade mark, with criminal intent, to interfere with the legitimate owner: up to 2 years, or a fine up to ₦5 million, or both (section 25(1)).

Where the two lists differ (for example, on the section number for forgery and fraud), answer from the one the question refers to, and remember the main figures: identity theft 7 years, forgery of electronic signatures 7 years, ATM theft 7 years, cyber terrorism life.

Electronic fraud

November 2021 asked what electronic fraud is (2 marks), and the examiners’ answer was fraud committed using electronic devices such as computers, phones and the internet. May 2023 and March/July 2020 asked for the evidence of it, which the earlier topic on electronic evidence covers. November 2022 asked for four ways of committing it in a business environment (4 marks). The examiners listed nine:

1. fraudulent use of business data and information illegally obtained from electronic devices;
2. falsification and manipulation of data obtained from the database of electronic devices;
3. fraudulent and illegal transfers of funds between business accounts;
4. hacking or breaking into codes of business accounts for fraud;
5. illegal insertion of codes into electronic devices to induce malfunction;
6. impersonation, presenting oneself fraudulently as a legitimate user;
7. identity theft;
8. cybersquatting; and
9. cyberstalking.

Data protection

Why it matters

The core idea was stated in R v Brown by Lord Hoffmann: vast amounts of information about everyone are stored on computers, capable of instant transmission anywhere in the world and accessible at the touch of a keyboard, and the right to keep oneself to oneself is under technological threat.

Cloud computing and e-commerce mean that almost every online service asks for a profile form, and databases of banks, immigration, telecoms, schools, hospitals, electoral and licensing bodies hold records on most citizens, who often do not know the purpose of the collection or the use by the data controllers. The persons whose data are captured are data subjects.

Concerns about data collection (World Wide Web Foundation, 2018)

The NITDA regulation 2019

Against that background NITDA issued the Nigeria Data Protection Regulation in 2019. It had four parts:

1. Part 1: objectives and scope, safeguarding the data of data subjects, covering natural persons whose data are collected (three sections, with key definitions);
2. Part 2 (12 sections): the governing principles, including procurement, informed consent and exceptions for transfers of data to foreign countries;
3. Part 3 (one section): the rights of data subjects; and
4. Part 4 (3 sections): implementation, administrative redress and foreign cooperation.

A notable feature was the annual data protection audit. NITDA licensed data protection auditors to audit companies and government agencies each year, and a data controller who failed to submit an annual audit report faced penalties that depended on the number of data subjects.

The Nigeria Data Protection Act 2023 and the GAID 2025

The current syllabus says that the Nigeria Data Protection Commission (NDPC), established under the Nigeria Data Protection Act 2023, replaced NITDA as the data protection regulator. In 2025 it issued the General Application and Implementation Directive (GAID) 2025, which replaced the 2019 Regulation. The GAID has 52 articles and 10 Schedules:

1. Principles of data protection;
2. Compliance audit returns under the Act;
3. Data protection officer’s assessment;
4. Data privacy impact assessment;
5. Guidance on cross-border data transfer;
6. Data subject’s vulnerability indexes;
7. Guidance notice on registration of data controllers and processors of major importance;
8. Legitimate interest assessment template;
9. Data subject’s standard notice to address grievance; and
10. Compliance audit returns filing fees.

Note that the 2019 Regulation is sometimes described as if it were the current rule, although the GAID replaced it. Treat the 2019 Regulation as the background and the Act and the GAID as the current framework.

Virtual evidence and electronic evidence

Virtual evidence is given by witnesses from remote locations using technology. It occurs in online courtrooms in three ways:

1. Audio hearing, by audio conferencing;
2. Video or virtual hearing, by video conferencing (Zoom, Skype, Teams, Webex, Duo); and
3. Paper hearing, by submitting and exchanging electronic writings online, and delivering judgment by the same means.

Virtual hearings became compelling with COVID-19 and the lockdown. The Evidence Act allows electronic evidence on conditions, but did not respond to virtual court proceedings. The courts, beginning with the Supreme Court, now issue practice directions allowing virtual proceedings and evidence.

Before the Evidence Act 2011 and the Cybercrimes Act 2015, electronic evidence was almost impossible to admit. The 2011 Act, which repealed the 2004 Act, now makes it admissible, on conditions: the earlier topic on bribery, money laundering and the expert witness sets out section 84.

Computer storage and data recovery devices

Data storage and recovery use electronic devices that help to provide evidence in prosecuting computer fraud. November 2016 asked for three, 2 marks each:

May 2016 also tested the rule that computer storage may be by one computer or by a combination of computers, all of which are treated as a single computer for admissibility under section 84.

Working through the rules

Which offence?

Who is who in data protection?

Penalty comparison

Worked problems

Problem 1: the online shop and the customer’s data

1. The concerns. This is the “purpose and usage mismatch”, and lack of informed consent and transparency.
2. The framework. Under the Nigeria Data Protection Act 2023, enforced by the NDPC, with the GAID 2025, data controllers must respect data subjects’ rights. The earlier 2019 Regulation set the principles of informed consent and the data subject’s rights.
3. Advice. The customer may complain to the NDPC, and the store is exposed to penalties. If the data were misused by fraud, the store’s officers may face criminal liability, and the customer may sue.

Problem 2: the accountant who hacks

1. Access. Unlawful access to a computer system (hacking).
2. The secrets. Obtaining commercial secrets without authority: up to 7 years, or a fine up to ₦7 million, or both.
3. The transfer. Fraudulent and illegal transfer of funds, an electronic fraud, and computer-related fraud under section 14(1).
4. Other law. Stealing under the Criminal Code, and money laundering reporting duties apply to the transfer.

Problem 3: a virtual trial

1. The rule. Virtual evidence is given by witnesses from remote locations by technology. The Evidence Act does not itself provide for virtual hearings, but the courts, from the Supreme Court down, issue practice directions allowing them.
2. The evidence. Any electronic document tendered must meet the conditions in section 84.
3. Advice. It is allowed under the practice directions.

Problem 4: choosing storage for evidence

1. Primary store. The hard disk drive in the computer.
2. Back-up. An external disk drive and a flash disk drive, which are secondary back-up devices for storage and recovery.
3. Advice. It should keep regular back-ups and records of how they were made, so that it can prove the conditions in section 84.

Questions that have been asked on this topic, and how to answer them

Common mistakes in the exam

• Saying electronic evidence is inadmissible. It is admissible on conditions under the Evidence Act 2011.
• Confusing the Cybercrimes Act with the Money Laundering Act.
• Mixing the penalties: identity theft, forgery of e-signatures and ATM theft carry 7 years, and cyberstalking 3 years.
• Saying NITDA is the current data protection regulator. The NDPC is.
• Saying the 2019 Regulation is current. The GAID 2025 replaced it.
• Forgetting that data subjects must give informed consent.
• Describing a hard disk as a back-up device. It is primary storage. External and flash disks are back-ups.
• Forgetting that virtual hearings are allowed by practice directions, not by the Evidence Act itself.

Quick revision

• E-commerce: business on the internet. Issues: contracts, payment default, data privacy, online crime. First cybercrime law 2015, amended 2024.
• Cybercrimes Act: protects national infrastructure, cybersecurity, computers, networks, data and intellectual property. Identity theft 7 years or ₦5m; e-signature forgery 7 years; ATM theft 7 years; fraud 3 years; cyberstalking 3 years; cyber terrorism life.
• Electronic fraud: fraud with computers, phones and the internet. Nine ways.
• Data protection: data subject and data controller, five concerns, 2019 Regulation (four parts, annual audit), Nigeria Data Protection Act 2023, NDPC, GAID 2025 (52 articles, 10 Schedules).
• Virtual evidence: audio, video and paper hearings, by practice directions. Storage: hard disk (primary), external disk and flash disk (back-up).

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Section A style: multiple choice

Section B style: written questions

Model answers

Spotted a mistake? Tell us and we will check it.