A Car Rental Company Withholding the Deposit and Charging the Credit Card Afterwards: Consumer and KVKK Rights

A deposit does not give the rental company unlimited authority to collect

In car rental transactions, a security deposit or a credit card pre-authorization is taken to secure the rental company’s possible receivables. However, this security does not mean that the company may, after the rental has ended, unilaterally convert any amount it wishes into a final collection.

For a deduction to be legally defensible, the following questions must be answered on the specific facts:

• Did the debt claimed really arise from this rental period?
• Is the contract provision on which the deduction is based clear, comprehensible and negotiated with the consumer?
• If damage is alleged, was the damage not already present at the time of delivery?
• Have the nature, cause and cost of the damage been proven by an objective document?
• Has a payment been made by insurance or a third party for the same loss?
• Is the amount claimed by the company proportionate to the actual loss?
• Can the deduction pass the unfair-term review under consumer law?
• Is the use of the card details based on a valid data processing condition under the KVKK?

The function of the deposit is “security”; where there is no loss or debt, it does not constitute an independent legal ground for the deposit to pass permanently into the company’s assets.

The pre-authorization on the credit card and a later final charge must be distinguished

The amount blocked on the credit card when the vehicle is delivered is often in the nature of a “pre-authorization.” A pre-authorization temporarily makes a certain portion of the card limit unavailable; a final collection, by contrast, means that the amount is transferred to the company’s account.

This distinction matters in practice. When the consumer says “the deposit still hasn’t come back,” it must first be determined which of the following has happened:

• The pre-authorization may not yet have been released in the bank’s system.
• The rental company may have converted the pre-authorization, in part or in full, into a sale.
• The company may have carried out a new card transaction separate from the pre-authorization.
• The bank may have processed the company’s refund instruction, but the limit may not yet be reflected on the card.

For this reason, the bank statement, the card transaction description, the authorization code and the rental company’s collection/refund records should be examined together.

A bank dispute and a legal refund claim are not the same thing

A dispute filed by the cardholder with the bank is an important first step, particularly for transactions alleged to have been made without the cardholder’s knowledge or without authorization. The Ministry of Trade’s consumer guide also explains that, for card transactions made without the consumer’s knowledge, the consumer should first apply to the bank and that banks should carry out a review under the chargeback rules.

However, a chargeback does not replace a refund/compensation claim arising from substantive law against the rental company. Even if the bank reverses the card transaction, the rental company may make a separate claim by alleging that a debt exists; even if the bank dispute is rejected, the consumer may still pursue the claim of an unjustified deduction through consumer law avenues.

The vehicle delivery and return documents are at the center of a deposit dispute

A significant share of deposit deductions are based on the claim that “new damage was found on the vehicle.” For this reason, the records at the time of delivery and return are the most critical evidence in the dispute.

The main records the consumer should keep are:

• The initial delivery form and the existing damage diagram.
• Photos/videos taken of all four sides of the vehicle, the rims, the windows and the interior.
• A record of the mileage, fuel level and date and time.
• The return form and the employee’s signature.
• Photos/videos of the moment the vehicle was left, if it was returned to a key drop box or without an attendant.
• The damage photos later sent by the company.
• The expert appraisal report, service report, repair invoice or quotation.
• The credit card pre-authorization and collection documents.

The approach of the Court of Cassation (Yargıtay) to deposits in lease relationships also shows that the loss or debt that would justify not refunding the deposit must be concretely established. In car rental specifically, it is also important to determine technically in which period and for what reason the damage occurred.

Unfair-term review: a clause saying “I may collect any amount I wish from any card I wish” may not be valid

Under Article 5 of Law No. 6502 and the Regulation on Unfair Terms in Consumer Contracts (Tüketici Sözleşmelerindeki Haksız Şartlar Hakkında Yönetmelik), provisions that are included in the agreement without being negotiated with the consumer and that, contrary to the rule of good faith, create a significant imbalance to the detriment of the consumer may be considered unfair terms.

The following types of provisions, often seen in standard car rental agreements, should be reviewed with particular care:

• “The company may collect from the card at any time it wishes.”
• “The consumer accepts in advance every damage amount determined by the company.”
• “The company may collect from all cards notified in past rentals.”
• “The company’s records are conclusive evidence without an expert appraisal or invoice being submitted.”
• “The deposit will not be refunded under any circumstances.”
• “All traffic, damage and diminished value costs are borne by the renter regardless of fault.”

The fact that a contract provision appears in printed form does not mean that it is automatically valid. It is assessed whether it was genuinely negotiated with the consumer, whether the provision is clear and comprehensible, and whether it upsets the balance of rights and obligations contrary to the rule of good faith.

KVKK Board 2020/166: using an old credit card for a new transaction was found unlawful

In its decision of 27.02.2020, No. 2020/166, the Personal Data Protection Board examined an attempt by a car rental company to use credit card details notified in an earlier rental agreement to collect an HGS charge incurred in a later rental.

In the specific case, the consumer had expressly approved a different credit card for the new rental. Despite this, the company had attempted to collect from another card registered in the previous rental.

The following points in particular stood out in the Board’s assessment:

• It was possible to collect from the card notified in the current agreement, whose validity had been verified by a pre-authorization.
• There was no concrete need requiring the use of another card left over from the previous agreement.
• The standard provision stating that “amounts may also be collected from cards notified in other agreements” was assessed as an unfair term in the specific case.
• Retaining the old card details in the system for possible future needs and using them was not compatible with the principles in Article 4 of the KVKK of compliance with the law and the rules of good faith and of being related to the purpose, limited and proportionate.
• The data processing activity could not be based on the conditions of establishment/performance of a contract or legitimate interest under Article 5 of the KVKK.

The Board decided to impose an administrative fine on the data controller for breach of the data security obligations under Article 12 of the KVKK.

This decision draws a very important line against the approach in the car rental sector that credit card details, “once given, can now be used for every transaction.”

What are the limits of the decision?

Decision No. 2020/166 does not mean that a car rental company can never, under any circumstances, collect from a card after the rental. Collection, through the card belonging to the current rental and whose use the consumer approved, of genuine and provable HGS charges, traffic fines, fuel differences or similar debts in accordance with the agreement and the law is assessed separately.

The real significance of the decision lies in the issues of using card details left over from another rental for a new transaction and retaining personal data unnecessarily after the purpose has ended.

Credit card details are personal data and cannot be retained indefinitely once the purpose has ended

A credit card number and the transaction information linked to the card are personal data to the extent that they can be associated with an identified or identifiable person.

Under Article 4 of the KVKK, personal data must be processed:

• lawfully and in accordance with the rules of good faith,
• accurately and, where necessary, kept up to date,
• for specified, explicit and legitimate purposes,
• in a manner related, limited and proportionate to the purposes for which they are processed,
• for the period laid down in the relevant legislation or required for the purpose for which they are processed,

and retained accordingly.

For this reason, the justification that “a debt might come up in the future” does not, on its own, justify retaining all card details indefinitely. Retention obligations arising from accounting, tax, limitation periods for actions, proof and the legislation may be different; however, in what technical form and for how long the full card data are retained must be assessed separately.

What are the consumer’s rights under the KVKK?

Under Article 11 of the KVKK, the data subject has the right, by applying to the data controller, to learn whether his or her personal data are processed, to request information if they have been processed, to learn whether they are used in accordance with their purpose, to know the third parties to whom they have been transferred, to request their erasure or destruction where the conditions are met, and to claim compensation if he or she suffers damage due to unlawful processing.

In an application to the car rental company, the following matters may be asked specifically:

• Which of my credit card details are held in your system?
• From which rental agreement were these data obtained?
• On which legal ground are they retained?
• On which dates and for which transaction purpose were they used?
• To whom have they been transferred?
• What is the retention period?
• What is the erasure/destruction procedure?
• What are the log and transaction records of the suspicious collection attempt?

The time limits for the application to the data controller and the subsequent complaint to the Board should be monitored separately under Articles 13 and 14 of the KVKK. If the data controller’s response is found insufficient or no response is given in time, the avenue of applying to the Board may come into question.

Which items can arguably be deducted from the deposit?

Under the current 2026 regime, within the framework of the rental agreement and the general rules of law, it may be possible to set off certain debts that have genuinely arisen and can be proven against the deposit. For example:

• Damage to the vehicle that occurred during the rental period and can be attributed to the renter.
• The cost of missing fuel or energy.
• An excess mileage fee in accordance with the agreement.
• HGS/motorway tolls belonging to the rental period.
• Amounts passed on to the company because of a traffic/parking violation attributable to the renter.
• Fees expressly regulated in the agreement for late return.

However, a three-part check should be carried out for each item: contractual basis + genuine debt/loss + proof.

Is the company’s unilateral record sufficient for the damage amount?

Particularly for high damage claims, an internal record or photo kept only by company personnel may not always be sufficient. Whether the damage was found at the time of return, whether it was already present when the vehicle was delivered, whether the repair was actually carried out, the market reality of the parts/labor costs and insurance payments should be investigated.

Diminished value and “loss of use” cannot be deducted automatically from the deposit

In addition to the repair cost, a car rental company may claim diminished value or loss of income for the period during which the vehicle was under repair. However, these items are types of loss separate from the repair cost.

For diminished value, there must be a genuine decrease in the vehicle’s second-hand market value after the repair; for lost rental income, the vehicle must have genuinely lost income during a reasonable repair period.

If not all of the company’s fleet vehicles are booked, if substitute vehicles of the same class are available, or if the period claimed exceeds the technical repair time, the alleged loss should be questioned separately.

A new era for deposit and damage deductions from January 1, 2027

The Regulation on the Rental of Motor Land Vehicles, published in the Official Gazette of August 15, 2026, No. 33341, will enter into force on January 1, 2027.

This regulation introduces important, clear rules on deposit and damage deductions in short-term car rentals made by consumers.

Upper limit on the deposit

Under the new Regulation, a deposit of

• at most three days’ rental fee for rentals of 1–6 days,
• at most seven days’ rental fee for rentals of 7–29 days or weekly rentals

may be taken.

A seven-day period for refunding the deposit

As a rule, the steps for refunding the deposit will be completed within 7 days following the date on which the agreement ends and the vehicle is returned.

This period requires a distinction between the time the bank takes to reflect the amount on the card limit and the rental company’s obligation to initiate the refund.

No deduction for ordinary wear and tear

No fee may be claimed from the consumer for wear and tear arising from ordinary use and within acceptable limits, and no deduction may be made from the deposit on this ground.

Independent expert appraisal and the return record

Under the new regime, documenting a claim for the cost of damage or a fault with an authorized and independent expert appraisal report, and drawing up delivery and return records, will gain great importance. It is envisaged that reports prepared by the business’s own personnel or by persons connected to it cannot be used in place of an independent expert appraisal.

The renter’s liability is also substantially limited for damage not stated in the delivery/return record.

Limit on unilateral collection for diminished value

The new Regulation contains an express protection providing that, except by agreement of the parties, no amount may be claimed or collected from the renter for diminished value without an insurance arbitration decision or another decision in the nature of an enforceable judgment (ilam).

Do the 2027 rules apply directly to a 2026 dispute?

As a rule, no. The new Regulation will enter into force on January 1, 2027. Therefore, unless there is an express retroactivity provision, the provisions of the new Regulation do not apply directly to a rental dispute completed in 2026 as though they had been in force.

However, the Regulation will create a much clearer regime of proof and deposits for disputes after 2027.

Can traffic fines and HGS charges be collected later?

Genuine HGS or traffic fine debts that come to the company’s knowledge after the rental has ended may be passed on to the consumer depending on the agreement and the circumstances of the specific case.

However, the following distinctions should be made:

• That the debt genuinely belongs to the rental period.
• That the plate and the date of the toll passage/violation match the rental period.
• That the principal public debt is separated from the “service/processing fee” added by the company.
• That the processing fee is expressly included in the agreement and does not constitute an unfair term.
• That the collection is made with the payment instrument that was approved and on the basis of a valid data processing condition.

In particular, using different card details from years earlier for this purpose may give rise to the risks identified in KVKK Board decision No. 2020/166.

A traffic fine and the company’s own “administrative processing fee” are not the same thing

A traffic or HGS debt is the principal debt paid to the public authority/operator. An “administration fee,” “processing fee” or “fine processing service fee” additionally claimed by the car rental company is, by contrast, a separate contractual item.

Whether this additional fee:

• is expressly included in the agreement,
• was notified to the consumer before the agreement was concluded,
• is proportionate to an actual service,
• constitutes an unfair term

should be examined separately.

What avenues can a foreign tourist pursue after leaving Türkiye?

The fact that a foreign tourist has returned to his or her country does not, by itself, eliminate the possibility of seeking rights against the car rental company in Türkiye.

A practical sequence of steps can be set up as follows:

1. A written objection and request for documents is sent to the rental company.
2. The transaction details are obtained from the bank and, if necessary, the card transaction dispute/chargeback process is initiated.
3. If there is a KVKK breach, an application is made to the data controller under Article 13 of the KVKK.
4. Depending on the monetary limit, the consumer dispute is taken to the Consumer Arbitration Committee (Tüketici Hakem Heyeti) or to mediation as a condition precedent to litigation and then the consumer court.
5. If the response to the KVKK application is insufficient or no response is given, a complaint to the Board is considered where the conditions are met.
6. If there is a suspicion of an unauthorized or fraudulent card transaction, the criminal law dimension is examined separately.

In 2026 the Consumer Arbitration Committee limit is TL 186,000

In 2026, an application may be made to the Consumer Arbitration Committee for consumer disputes with a value below TL 186,000. For disputes of exactly TL 186,000 or more, subject to the exceptions in the law, the consumer court comes into question after mediation as a condition precedent to litigation.

The following documents are particularly important in an application to the Consumer Arbitration Committee:

• The rental agreement and general terms.
• The reservation and payment documents.
• The deposit/pre-authorization record.
• The vehicle delivery and return forms.
• Photos and videos.
• Damage/expert appraisal/invoice documents.
• The credit card statement.
• Correspondence with the company.
• Bank dispute documents.
• A calculation breakdown of the amount claimed.

The foreign consumer’s residence in Türkiye, foreign identity number and the possibility of an electronic application should be assessed separately with regard to the specific method of application; where necessary, an application through a lawyer may be planned.

In which situations should a separate KVKK application be made?

The following situations should be examined separately from the personal data perspective:

• Use of the card used in a previous rental for a new transaction.
• Retention of card details for an unnecessary period.
• Continued retention of the data despite the consumer’s erasure request.
• Sharing of card or identity details with unauthorized third parties.
• Collection of personal data unrelated to the purpose of the rental.
• Processing of data without a privacy notice being provided.
• Exposure of payment data due to a security breach.

A KVKK application is not the same as the refund of the consumer’s receivable. In the same event, parallel processes may exist under both consumer law and personal data protection law.

What should be checked when the company argues “you signed the agreement”?

A signature does not mean that every term is automatically valid. Particularly in standard agreements, the following checks should be carried out:

• Was the provision genuinely negotiated with the consumer?
• Is the provision clear and comprehensible?
• Was the consumer informed about this matter before the agreement was concluded?
• Does the provision create an imbalance to the detriment of the consumer contrary to the rule of good faith?
• Does applying the provision breach another mandatory regulation such as the KVKK?
• Does the event put forward by the company genuinely meet the conditions for applying the provision?

In Board decision No. 2020/166 as well, the existence of a general collection provision in the agreement was not, on its own, accepted as sufficient; the circumstances of the specific case were assessed separately.

What is the strongest set of documents for proof?

It is useful to build the following set of documents from the first day of the dispute:

Rental documents

• The reservation confirmation.
• The rental agreement and general terms.
• Additional insurance/coverage documents.
• Driver and additional driver records.

Vehicle condition documents

• The delivery form.
• The return form.
• Photos/videos.
• Expert appraisal/service documents.

Payment documents

• The rental payment.
• The deposit/pre-authorization.
• Receipts for deductions/charges.
• The bank statement.
• Chargeback/dispute correspondence.

Data protection documents

• The KVKK privacy notice.
• Records relating to explicit consent or another basis for data processing.
• The application made to the data controller.
• The company’s response.
• Records relating to the erasure/destruction request.

Conclusion

A car rental company’s failure to refund the deposit, or its withdrawal of money from the credit card after the rental, does not, on its own, mean that the transaction is lawful. For every collection, the contractual basis, the genuine debt or loss, the proof and the law on the processing of personal data must be reviewed together.

In particular, using credit card details left over from a previous rental in a later transaction may, in light of KVKK Board decision No. 2020/166, create a serious data protection and unfair-term problem. For the consumer, a bank dispute, a written application to the rental company, the Consumer Arbitration Committee/court avenues and a KVKK application do not have to be alternatives to one another; depending on the nature of the event, they may proceed together or in sequence.

The new car rental Regulation, which will enter into force on January 1, 2027, will make consumer protection even more concrete with respect to deposit limits, the seven-day refund, the delivery and return record, independent expert appraisal and the collection of diminished value. However, it should not be forgotten that today’s law applies to disputes dating from 2026.

Frequently Asked Questions

Can a car rental company keep my deposit without reason?

No. The deposit is a security amount. The company must base any deduction on a genuine, provable debt or loss in accordance with the agreement.

Can money be withdrawn from my credit card after I return the vehicle?

Depending on the specific debt and the contract terms, certain later items such as HGS charges, traffic fines or similar items may be collected; however, the collection must be made from an authorized payment instrument and based on a clear legal ground.

Can a debt from a new rental be charged to the card I used in an old rental?

Generally, no. In its decision No. 2020/166, the KVKK Board found unlawful, in the specific case, the use of a card left over from a previous rental for the debt of a later rental.

If I file a chargeback with the bank, is there no need for any other step?

No. A chargeback is a banking avenue concerning the card transaction. Consumer law or KVKK applications against the rental company may also be necessary.

Is it enough for them to send a photo of the damage?

Not always. It must also be proven that the damage occurred during the rental period and was not present at delivery, as well as its cause and cost. For high-value claims, expert appraisal and repair documents are important.

What will the maximum deposit be in 2027?

Under the Regulation entering into force from January 1, 2027, a deposit of at most three days’ rental fee may be taken for rentals of 1–6 days, and at most seven days’ rental fee for rentals of 7–29 days or weekly rentals.

Within how many days will the deposit be refunded in 2027?

The new Regulation provides that, as a rule, the refund steps will be completed within 7 days following the return of the vehicle and the end of the agreement.

How long can the company retain my old credit card details?

No single fixed period applies to all situations. Retention must be limited to the processing purpose, the legal obligations and the necessary period. When the purpose ceases to exist, erasure, destruction or anonymization comes into question under Articles 4 and 7 of the KVKK.

What information can I request from the company under the KVKK?

You may request which of your data are processed, for which purpose and on which legal ground they are held, to whom they have been transferred and, where the conditions are met, their erasure/destruction.

Up to what amount can an application be made to the Consumer Arbitration Committee in 2026?

In 2026, an application may be made to the Consumer Arbitration Committee for consumer disputes below TL 186,000.

Can a foreign tourist apply after leaving Türkiye?

Yes. By planning the power of attorney, translation and identity documents according to the specific type of application, the consumer and KVKK avenues in Türkiye can be used.

Can the company defend every deduction by saying “it is in the agreement”?

No. Standard contract provisions are subject to unfair-term review; in addition, terms that breach other mandatory rules of law are not accepted as valid.

Can a separate service fee be added to an HGS charge or traffic fine?

Only a service fee that is expressly regulated in the agreement, notified in advance and not constituting an unfair term may come into question. The principal public debt and the company’s additional processing fee are separate items.

If the company has breached the KVKK, will my money be refunded automatically?

No. A KVKK breach and the refund of the consumer’s receivable are separate legal consequences. Two separate avenues of application may be needed for the same event.

Sources and legal bases

1. Law No. 6502 on Consumer Protection (6502 sayılı Tüketicinin Korunması Hakkında Kanun), in particular Articles 5, 68, 73 and 73/A.
2. Personal Data Protection Law No. 6698 (6698 sayılı Kişisel Verilerin Korunması Kanunu), in particular Articles 4, 5, 7, 11, 12, 13, 14 and 18.
3. Regulation on Unfair Terms in Consumer Contracts (Tüketici Sözleşmelerindeki Haksız Şartlar Hakkında Yönetmelik), Official Gazette 17.06.2014/29033.
4. Regulation on the Rental of Motor Land Vehicles (Motorlu Kara Taşıtlarının Kiralanması Hakkında Yönetmelik), Official Gazette 15.08.2026/33341; effective date 01.01.2027.
5. T.R. Ministry of Trade (T.C. Ticaret Bakanlığı), the 2026 monetary limit of the Consumer Arbitration Committee and information on consumer applications.
6. T.R. Ministry of Trade, information note dated 21.08.2026 on the Regulation on the Rental of Motor Land Vehicles.
7. Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), Decision Summary No. 2020/166 dated 27.02.2020, “On the use by a car rental company, as data controller, of credit card details whose use the data subject had not authorized” (İlgili kişinin kullanımına izin vermediği kredi kartı bilgilerinin veri sorumlusu araç kiralama şirketi tarafından kullanılması hakkında).
8. Court of Cassation (Yargıtay) case law on assessing the damage, the debt and the conditions for refunding the deposit in car rental and deposit disputes on the basis of concrete evidence.
9. In the specific dispute concerned, the consumer court and the general rules on subject-matter jurisdiction should be assessed separately according to the nature of the car rental agreement.