Governance

encargado

Mandated processor acting on behalf of a controller.

Definition

A third‑party provider contracted to process personal data on behalf of a public entity (the controller), bound by a written mandate that specifies instructions, permitted operations, duration, subcontractor restrictions, security measures, audit rights, and return/deletion obligations; the directive requires explicit contractual clauses for encargados in procurement contracts.