Data stored on the device is the responsibility of the organisation operating the device and the operating organisation is responsible for ensuring compliance with relevant data protection legislation. This includes the requirement to ensure that personally identifiable data is deleted from the device prior to the device being returned to the manufacturer