an entity that has limited access to the data that it receives as a result of being bound by some administrative control such as a law, regulation, or data use agreement
Sources:
NISTIR 8053