Joshua Gray

Joshua Gray is a technology and data-focused lawyer with a distinctly international practice that combines commercial and regulatory expertise. He excels in assisting clients for deals with no precedent where technology and data are at the heart of the project.

Joshua advises on the structuring and negotiation of bespoke technology projects, with a particular focus on AI technologies and large-scale digital infrastructure transactions. His practice includes advising on the full life cycle of data centre projects—from regulatory diligence and corporate transactions to strategic commercial arrangements, co-location and other operational agreements. He also advises leading AI model providers on regulatory matters and strategic collaborations with government agencies on AI safety and testing issues.

Joshua otherwise advises on the full spectrum of technology transactions, including IT services agreements, outsourcing, software development and licensing, cloud computing and infrastructure, M&A and joint ventures.

Joshua has deep industry knowledge and experience in the AI, digital infrastructure, technology, life sciences and travel sectors. This experience has been bolstered through client secondments to Illumina Inc, Barclays Bank and du, a leading telecoms operator in the UAE.

Contact:

Amadeus IT Group Receives GDPR Fine

By Joshua Gray, Nigel Howard & Will Capstick on June 17, 2026

Posted in Data Protection, EU Law and Regulatory, European Union, GDPR

On May 26, 2026, the Spanish Data Protection Agency (“AEPD”) published details of its decision to fine Amadeus IT Group, S.A. (“Amadeus”), a Madrid-headquartered technology provider for the global travel and tourism industry, EUR 18 million in connection with GDPR violations involving Amadeus’s Global Distribution System (“GDS”). Amadeus voluntarily paid the fine, less a 20% reduction, on May 29, 2025, thereby terminating the proceedings without admitting liability. The fine, one of the largest the AEPD has imposed, highlights the enforcement risks associated with repurposing personal data such as passenger data without appropriate transparency or a valid legal basis under the GDPR.