Courts and businesses now use technology as a matter of routine. Witnesses give evidence over a video link, contracts are made by email, and fraud is committed through a keyboard. The law has had to catch up, and the syllabus devotes a section to three developments: evidence given through technology, the Cybercrimes Act and the new data protection regime.
This topic gives you the framework. The detailed rules on electronic evidence and on fraud are covered further in the chapters on criminal law and contract.
In 30 seconds
Virtual evidence is evidence given from a remote place through technology. Courts allow it through audio, video and paper hearings, under practice directions. The Cybercrimes Act, as amended in 2024, creates offences such as identity theft, hacking, phishing, spreading malware, cyberstalking and cybersquatting, each with its own penalty.
The Nigeria Data Protection Act 2023 set up the Nigeria Data Protection Commission, and the 2025 General Application and Implementation Directive replaced the older Nigeria Data Protection Regulation 2019.
Virtual evidence and hearings
Virtual evidence is evidence given by witnesses from remote locations through technology, in online courtrooms. Hearings take three forms.
| Form | How it works |
|---|---|
| Audio hearing | Through audio conferencing |
| Video or virtual hearing | Through video conferencing tools such as Zoom, Teams and Webex |
| Paper hearing | Written documents are submitted and exchanged online, and judgment is delivered the same way |
Virtual hearings became necessary during the COVID-19 lockdown. The Evidence Act allows electronic evidence to be admitted on certain conditions, but it was not written for virtual proceedings. The courts, starting with the Supreme Court, have therefore issued practice directions that allow virtual proceedings and virtual evidence.
The Cybercrimes Act
The Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024, tackles crime committed through computers and networks. The syllabus lists these offences and penalties.
| Offence | Meaning | Penalty recorded in the syllabus |
|---|---|---|
| Identity theft | Using another person’s identity dishonestly | Up to 7 years, or a fine of ₦5 million, or both |
| Offences against critical national infrastructure | Attacks on systems the President designates as critical | Up to 10 years with no option of a fine, or 15 years if grievous bodily harm results |
| Hacking and internet fraud | Unlawful, intentional access to a computer system | A fine of up to ₦5 million, or up to 5 years, or both |
| Unauthorised obtaining of data or secrets | Getting computer data, commercial or industrial secrets or classified information without authority | Up to 7 years, or a fine of up to ₦7 million, or both |
| Hindering a computer system | Inputting, damaging, deleting or altering data to disrupt a system | Up to 2 years, or a fine of up to ₦5 million, or both |
| Phishing | Obtaining usernames, passwords or card details by pretending to be a trustworthy source | 3 years, or a fine of ₦1 million, or both |
| Spreading malware | Deliberately spreading viruses, ransomware, spyware, worms or trojans that damage information in public, private or financial institutions | 3 years, or a fine of ₦1 million, or both |
| Selling tools for cybercrime | Offering, selling or distributing hardware or software used to commit cybercrime | Up to 3 years, or a fine of up to ₦7 million, or both |
| Cyberstalking and cyberbullying | Using electronic means to harass or threaten | A fine of up to ₦7 million, or up to 3 years, or both |
| Cybersquatting | Registering or using a domain name, business name or trademark of another with criminal intent | Up to 2 years, or a fine of up to ₦5 million, or both |
Data protection law
The Nigeria Data Protection Act 2023 created the Nigeria Data Protection Commission, which replaced the National Information Technology Development Agency as the regulator. In 2025 the Commission issued the General Application and Implementation Directive (GAID), which, according to the syllabus, replaced the Nigeria Data Protection Regulation 2019.
The directive has 52 articles and ten schedules, covering the principles of data protection, compliance audit returns, the data protection officer’s assessment, data privacy impact assessments, guidance on cross-border transfers, data subjects’ vulnerability indexes, registration of data controllers and processors of major importance, a legitimate interest assessment template, a standard notice for data subjects’ grievances, and filing fees.
The syllabus still names the 2019 Regulation, so know the principles that both rest on. Personal data must be processed lawfully, fairly and transparently, collected for a specified purpose, limited to what is needed, kept accurate, kept no longer than necessary, held securely and confidentially, and handled by a controller who can show that it complies.
Worked example: classifying the offence
Scenario. An employee emails customers pretending to be the bank and obtains their passwords. He then uses them to move money, and posts false messages to harass one customer who complained. Name the offences.
| Act | Offence |
|---|---|
| Pretending to be the bank to obtain passwords | Phishing |
| Using the passwords to move money | Hacking and internet fraud, and identity theft |
| Harassing the customer online | Cyberstalking |
Each is a separate offence with its own penalty. The firm would also have to handle the breach of its customers’ personal data under the data protection law.
Cybercrime and data protection in more detail
The offences explained
- Identity theft is dishonestly using another person’s personal identity, for example a name, number or credentials, to obtain benefit or cause loss. A fraudster who opens a bank account in a customer’s name commits it.
- Offences against critical national infrastructure carry heavier penalties, with no option of a fine, because an attack on systems such as power or financial networks harms the whole country.
- Hacking and internet fraud mean unlawful, intentional access to a computer system, including defrauding people through the internet.
- Unauthorised obtaining of data covers securing access to a programme, commercial or industrial secrets or classified information without authority. An employee who copies a rival’s customer database commits it.
- Hindering a computer system means disrupting it by inputting, damaging, deleting or altering data. A denial-of-service attack is an example.
- Phishing and malware were met in the topic on cybersecurity in Business Environment. Phishing tricks people into disclosing information. Malware, including ransomware, spyware, worms and trojans, damages information held by public, private or financial institutions.
- Selling tools for cybercrime covers offering or distributing hardware or software designed for such offences.
- Cyberstalking and cyberbullying mean harassing or threatening someone electronically.
- Cybersquatting means registering or using a domain name or other name that belongs to another person, business or government, with criminal intent, so as to interfere with the rightful user.
For exam answers, state the offence, give a short meaning, and quote the penalty. Where the penalty offers a choice, say so: imprisonment, a fine, or both.
The principles of data protection, explained
| Principle | What it requires | Example |
|---|---|---|
| Lawfulness, fairness and transparency | There must be a lawful basis for using data, it must be used fairly, and people must be told what is done with it | A privacy notice that explains why a firm collects customer data |
| Purpose limitation | Data collected for one purpose may not be used for an unrelated one | Email addresses collected for receipts are not used for unrelated marketing without consent |
| Data minimisation | Collect only what is needed | A newsletter form does not ask for a home address |
| Accuracy | Keep data correct and up to date | Correcting a customer’s changed phone number |
| Storage limitation | Keep data no longer than needed | Deleting records of unsuccessful job applicants after a set period |
| Integrity and confidentiality | Protect data from loss, damage and unauthorised access | Encryption and access controls |
| Accountability | The controller must be able to show that it complies | Keeping records of processing and audit returns |
People whose data is held, called data subjects, have rights, including to be informed, to see their data, to have errors corrected, to have data erased in the right circumstances, to object to some uses and to move their data. A controller decides why and how data is processed, and a processor does it on the controller’s behalf.
The 2025 directive adds practical tools: audit returns, an assessment by the data protection officer, privacy impact assessments, guidance on sending data abroad, registration of controllers and processors of major importance, and a standard notice for a data subject to raise a grievance.
Virtual evidence: benefits and difficulties
Virtual hearings save travel and cost, allow witnesses abroad or in poor health to testify, and keep courts running during disruption. The difficulties are unreliable connections, the risk that a witness is coached or reads from notes out of view, confirming a witness’s identity, keeping documents and recordings secure, and unequal access to technology. The practice directions try to meet these risks while keeping the hearing fair.
What this means for an accountant
Accountants hold client and employer data, so data protection duties apply to them directly. A breach of client data can lead to regulatory penalties, claims and loss of reputation. Cybercrime is a fraud risk that an accountant may meet as an investigator or an expert witness, and electronic records are central evidence. The next chapters return to both points.
Electronic evidence: admissibility and authentication
Examiners have asked how computer-generated evidence is admitted and how an email is authenticated. The rules come from the Evidence Act, and the detailed application is covered in the criminal law chapter. The core points are these.
Why special rules exist
A printout from a computer is not an original document in the usual sense. It is the product of a machine that stores and processes data. The court therefore needs assurance that the machine was working, that the data was entered in the ordinary course, and that the printout accurately reflects it. Otherwise anyone could produce a false document and claim it came from a computer.
The conditions for admitting a computer-produced statement (section 84 of the Evidence Act 2011)
- The document was produced by the computer during a period when it was used regularly to store or process information for the purposes of activities regularly carried on during that period by the person who had lawful control of its use.
- During that period, information of the kind in the document was regularly supplied to the computer in the ordinary course of those activities.
- Throughout the material part of that period the computer was operating properly, or, if not, any fault did not affect the production of the document or the accuracy of its contents.
- The information in the document reproduces or is derived from information supplied to the computer in the ordinary course of those activities.
The certificate
A person who wants to rely on the document must give a certificate that identifies the document, describes how it was produced, gives particulars of the device used, and deals with the conditions above. It must be signed by a person in a responsible position in relation to the operation of the device or the management of the activities concerned.
The Supreme Court has insisted on compliance with this requirement (for example in Kubor v Dickson), and a printout tendered without a proper certificate may be rejected.
Authenticating an email
To tender an email, the party should produce the printout with a section 84 certificate, and show who sent it and who received it, using the addresses, date and time, headers or metadata, and any reply that refers to it. A witness who sent or received the message can identify it. A forensic expert can explain the origin and show that it was not altered.
Linking the email to the person, through the account used, the content and the context, is the heart of authentication.
Virtual evidence and electronic evidence compared
Virtual evidence is about how a witness gives evidence (over a video link). Electronic evidence is about what is produced as an exhibit (an email, a message, a database record). The first is regulated by practice directions, the second by section 84 and the general rules on documents.
Questions that have been asked on this topic, and how to answer them
| Question theme | What a full answer contains |
|---|---|
| State the conditions for the admissibility of computer-generated evidence | The four conditions and the certificate, with the reason for each |
| How may an email be authenticated in an electronic fraud case? | The certificate, sender and recipient details, metadata, a witness who sent or received it, expert evidence and links to the accused |
| State offences under the Cybercrimes Act and their penalties | The offence, a short meaning and the penalty, for as many as asked |
| Explain the data protection regime | The 2023 Act, the Commission, the 2025 directive replacing the 2019 Regulation, the principles and data subject rights |
| Explain virtual hearings | Audio, video and paper hearings, why they arose and the practice directions |
Common mistakes in the exam
- Naming an offence without its penalty when the question asks for both.
- Quoting an offence from the 2015 Act without the 2024 amendment.
- Saying the 2019 Regulation is still the main data protection instrument. The syllabus says the 2025 directive replaced it.
- Confusing phishing, which obtains information by deceit, with hacking, which gains unauthorised access to a system.
- Treating virtual evidence as outside the law. Courts allow it through practice directions.
Quick revision
- Virtual hearings: audio, video and paper.
- Cybercrimes Act 2015, amended in 2024: identity theft, critical infrastructure, hacking, data theft, hindering systems, phishing, malware, tools, cyberstalking, cybersquatting.
- Data protection: the 2023 Act, the Commission, and the 2025 directive that replaced the 2019 Regulation.
Practice questions
These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer.
Section A style: multiple choice
Question 1. Evidence given by a witness from a remote location through technology is called:
- Hearsay
- Virtual evidence
- Real evidence
- Documentary evidence only
Show the answer
B.
Question 2. Obtaining usernames and passwords by pretending to be a trustworthy source in electronic communication is:
- Cybersquatting
- Phishing
- Cyberstalking
- Hacking only
Show the answer
B.
Question 3. The regulator of data protection in Nigeria under the 2023 Act is the:
- Nigerian Communications Commission
- Nigeria Data Protection Commission
- Central Bank of Nigeria
- Corporate Affairs Commission
Show the answer
B. It replaced the National Information Technology Development Agency in that role.
Question 4. Registering a domain name that belongs to another business with criminal intent is:
- Cybersquatting
- Phishing
- Identity theft
- Malware distribution
Show the answer
A.
Question 5. A virtual hearing carried out through the exchange of electronic documents is a:
- Paper hearing
- Video hearing
- Audio hearing
- Live hearing
Show the answer
A.
Question 6. According to the syllabus, the 2025 General Application and Implementation Directive replaced the:
- Nigeria Data Protection Act 2023
- Nigeria Data Protection Regulation 2019
- Evidence Act
- Cybercrimes Act
Show the answer
B.
Question 7. The principle that data must be kept no longer than needed is:
- Data minimisation
- Storage limitation
- Accuracy
- Purpose limitation
Show the answer
B.
Question 8. A person who decides why and how personal data is processed is the:
- Data subject
- Data controller
- Data processor
- Regulator
Show the answer
B. A processor acts on the controller’s behalf.
Question 9. An attack that floods a system so that legitimate users cannot reach it is closest to the offence of:
- Cybersquatting
- Hindering the functioning of a computer system
- Identity theft
- Phishing
Show the answer
B.
Question 10. Which of these is a difficulty of virtual hearings?
- Lower cost
- Confirming a witness’s identity and preventing coaching
- Witnesses abroad can testify
- Courts can keep working during disruption
Show the answer
B.
Section B style: written questions
Question 11 (10 marks). Explain the three ways in which virtual hearings are conducted, and why the courts allow them.
Show the marking guide
Audio, video and paper hearings, 2 marks each with an explanation (6 marks). They became necessary during the lockdown, and the Evidence Act does not cover them, so courts issued practice directions (4 marks).
Question 12 (20 marks).
(a) State six offences under the Cybercrimes Act and their penalties. (12 marks)
(b) Explain the changes in the data protection framework made by the 2023 Act and the 2025 directive. (8 marks)
Show the marking guide
(a) 12 marks, 2 each. Six offences from the table with the penalty for each.
(b) 8 marks. The 2023 Act created the Commission as the regulator in place of the information technology agency (3). The 2025 directive was issued by the Commission and replaced the 2019 Regulation (3). Its content: 52 articles and ten schedules covering principles, audits, impact assessments and cross-border transfers (2).
A further written question
Question 13 (10 marks). Explain the principles of data protection that an organisation should follow.
Model answers
Show the model answer to Question 11
Virtual hearings take three forms. In an audio hearing, parties and witnesses take part by audio conference. In a video or virtual hearing, they take part through video conferencing tools such as Zoom or Teams, so the court can see and hear the witness. In a paper hearing, the parties submit and exchange written documents online and the court delivers judgment by the same means.
The courts allow them for three reasons. They became necessary during the COVID-19 lockdown. The Evidence Act allows electronic evidence on conditions but was not written for virtual hearings. So the courts, beginning with the Supreme Court, issued practice directions to permit virtual proceedings and virtual evidence, which also saves cost and widens access.
Show the model answer to Question 12
(a) Six offences and penalties. Identity theft: up to seven years or a fine of ₦5 million, or both. Hacking, including internet fraud: a fine of up to ₦5 million or up to five years, or both. Unauthorised obtaining of data or secrets: up to seven years or a fine of up to ₦7 million, or both.
Hindering a computer system: up to two years or a fine of up to ₦5 million, or both. Phishing: three years or a fine of ₦1 million, or both. Cyberstalking and cyberbullying: a fine of up to ₦7 million or up to three years, or both. Others are attacks on critical national infrastructure, spreading malware, selling tools for cybercrime and cybersquatting.
(b) Changes in data protection. The Nigeria Data Protection Act 2023 created the Nigeria Data Protection Commission, which replaced the National Information Technology Development Agency as the regulator. In 2025 the Commission issued the General Application and Implementation Directive, which, according to the syllabus, replaced the 2019 Regulation.
The Directive has 52 articles and ten schedules covering the principles of data protection, compliance audit returns, the data protection officer’s assessment, privacy impact assessments, cross-border transfers, data subjects’ vulnerability, registration of controllers and processors of major importance, legitimate interest assessments and grievance notices.
Show the model answer to Question 13
Personal data must be processed lawfully, fairly and transparently, so that there is a lawful basis and people are told what is done with their data. It must be collected for a specified purpose and not used in an unrelated way. Only what is needed should be collected, which is data minimisation. Data must be accurate and kept up to date.
It must be kept no longer than necessary. It must be held securely and confidentially to prevent loss, damage and unauthorised access. Finally the controller must be accountable, able to demonstrate compliance, for example through records and audit returns.
Pathfinder on virtual evidence, cybercrime and data protection
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
From the Business Law paper set under the previous syllabus. Part (a) asks for conditions for admitting computer-generated evidence. This topic gives the framework. The detailed rules are in the criminal law chapter.
Revise first: Virtual evidence and hearings
From the Business Law paper set under the previous syllabus. Part (a) asks how an email is authenticated as evidence in an electronic fraud case. The detail is in the criminal law chapter.
Revise first: Virtual evidence and hearings
Multiple-choice questions can test the offences under the Cybercrimes Act and the data protection authorities. Check Section A of every diet you practise for items on these points.
Revise first: The Cybercrimes Act
Source: ICAN Pathfinder, Corporate and Business Law. Diets covered: May Diet, 2022 to May Diet, 2024. Earlier diets are mapped where they fit.
Spotted a mistake? Tell us and we will check it.
