Recital 29

Data holders may require appropriate user identification to verify a user’s entitlement to access the data. In the case of personal data processed by a processor on behalf of the controller, data holders should ensure that the access request is received and handled by the processor.