Encapsulation (prepending of lower-layer header) and decapsulation (removal of that header) happen within each layer.
The "payload" (SDU data) to send is passed from the higher layer, possibly along with some metadata. Then the layer creates its header, embeds (encapsulates) the payload to create its PDU and passes that down the stack to the next lower layer. The physical layer is an exception, it encodes the "payload" for the physical link and moves the encoded bits from one place to the other. When data is received all the steps above happen in reverse.
This answer shows the encapsulation in more detailed example.
Whether that happens within a host OS, inside a NIC, in a switch, router, ... is a matter of implementation. Traditionally, physical layer encoding and data link layer encapsulation happen inside a NIC, network and transport layer encapsulation in the OS's stack, application layer encapsulation in the actual application. Today, many functions have been "offloaded" down the layer stack, so a NIC can also be responsible for network and transport layer functions, including encapsulation.