Yes; an organisation can request a user to provide ID. They need to be satisfied that they know the identity of the requester (or the person the request is made on behalf of - more on that later), otherwise they could be giving away someone else’s personal information. The timeframe for responding to a DSAR doesn’t start until the identification has been received by the organisation. However, it is expected that the ID documents are requested promptly by the organisation.