How to appear legitimate when asking authorities about sensitive data for research?
Academic fieldwork is often a political game and appearing legitimate is certainly a key issue. I think if you are legitimate and upfront about where you work and what you want to do that aspect can be covered quite easily. But if there are sensitive data that they are not allowed to share, it will not matter who you are.

I think the first thing to do is to disclose your affiliation and explain what your are working on and how this organization's data are relevant to your study.

There are other aspects to consider so I will go slightly off topic here. It's sometimes very difficult to explain academic imperatives even to highly educated staff who work in other types of environments. They might perceive your work as an audit of their practices and can interpret your analysis as a challenge to their expertise. They might also want oversight on your writing and ask you to present their work in a positive way. You will have to be very diplomatic in that regard.

I think it safer to discuss data policy in advance: what you want to gather, what you will be showing in your thesis. They might ask for control over how their data will be published. You need to know in advance, ideally in written, what is OK and what not. The last thing you need is them to give you trouble when you're finishing up your thesis or after a paper is published.