Where a third party is making a DSAR on behalf of a data subject then the organisation must satisfy itself that the request being made is genuinely by the individual whose data is being sought.