Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{210782,
        author = {Siddhanth D. Tarafder and Dr. Bonthu Kotaiah},
        title = {AI-ASSISTED PERSONAL DATA SECURITY GAP ASSESSMENT FOR INDIAN MSMEs: DESIGN AND IMPLEMENTATION OF A DPDP RULE 6 DECISION-SUPPORT PROTOTYPE},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {13},
        number = {6},
        pages = {2089-2095},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=210782},
        abstract = {Indian Micro, Small and Medium Enterprises (MSMEs) may find it difficult to translate personal-data protection requirements into operational security controls, particularly when they have limited legal, technical and financial resources. This paper describes DPDP Sentinel, an academic decision-support prototype designed to help Indian MSMEs conduct a structured self-assessment of reasonable security safeguards associated with Section 8(5) of the Digital Personal Data Protection Act, 2023 and Rule 6 of the Digital Personal Data Protection Rules, 2025. The implementation combines a React interface, FastAPI backend, SQLite persistence, a deterministic assessment engine, a seven-category regulatory knowledge base, retrieval-supported explanations, optional Google Gemini generation, human-review flags, dashboard visualisations and printable report output. The repository contains 30 synthetic organisational scenarios and a module labelled as a comparison of rule-based, zero-shot LLM and hybrid approaches. Code inspection reveals, however, that the latter two outputs are simulated using programmed rules rather than generated by independently executed models; the reported metrics therefore do not yet establish valid comparative AI performance. This paper documents the implemented system, identifies methodological and field-level limitations, and proposes an evaluation plan using expert-labelled scenarios, actual model outputs and MSME usability testing. DPDP Sentinel is a research prototype, not a legal certification tool.},
        keywords = {Digital Personal Data Protection Act; DPDP Rules 2025; MSME; security safeguards; compliance decision support; retrieval-augmented generation; explainable AI.},
        month = {November},
        }