Britain’s legal regime governing mass surveillance of the internet by intelligence agencies does not violate human rights, a tribunal has ruled.

But the investigatory powers tribunal (IPT) said it had identified one area where it has concerns about the adequacy of legal safeguards.

The tribunal will decide whether the human rights groups that brought the case have had their communications intercepted unlawfully in the past and whether any interception discovered was proportionate. The judgment said: “We have left open for further argument the question as to whether prior hereto there has been such a breach.”

Human rights groups that brought the challenge said they would appeal to the European court of human rights in Strasbourg against the overall finding that the surveillance and information sharing with US agencies, such as the National Security Agency (NSA), is legal.

The case against the GCHQ monitoring agency at the IPT was prompted by revelations from the US whistleblower Edward Snowden and was brought by Privacy International, Liberty, Amnesty International, the American Civil Liberties Union and a number of other overseas human rights groups.

The organisations claimed their private communications may have been monitored under GCHQ’s electronic surveillance programme, Tempora, whose existence was revealed by Snowden. They also argued that information obtained through the Prism and Upstream programmes of the NSA may have been shared with British intelligence services, sidestepping protections provided by the UK legal system.

During the hearing, Matthew Ryder QC, for Liberty, had alleged that the intelligence services were constructing vast databases out of accumulated interceptions of emails.

Ben Jaffey, for Privacy International, had claimed that the Regulation of Investigatory Powers Act (Ripa) had stopped providing the significant safeguards it once guaranteed against interception of communications without an individual warrant.But the tribunal judgment said: “… we are entirely clear that the [agencies] are not seeking, nor asserting that the system entitles them to seek to carry out what has been described as ‘mass’ or ‘bulk’ surveillance.”

It concluded: “Save in one possible (and to date hypothetical) respect, we have ruled that the current regime, both in relation to Prism and Upstream [intercept programs] … when conducted in accordance with the requirements which we have considered, is lawful and human rights compliant …

“Technology in the surveillance field appears to be advancing at breakneck speed. This has given rise to submissions that the UK legislation has failed to keep abreast of the consequences of these advances and is ill-fitted to do so, and that in any event parliament has failed to provide safeguards adequate to meet the developments.

“All this inevitably creates considerable tension between the competing interests, and the Snowden revelations in particular have led to the impression voiced in some quarters that the law permits the intelligence services carte blanche to do what they will. We are satisfied that this is not the case.”The legal challenge was the first of dozens of GCHQ-related claims to be examined in detail by the IPT, which hears complaints against British intelligence agencies and government bodies that carry out surveillance under Ripa. Some of the most sensitive evidence about interceptions was heard in private sessions from which the rights groups were excluded. In defence documents that were released, the government’s most senior security official, Charles Farr, explained how searches on Google, Facebook, Twitter and YouTube, as well as emails to or from non-British citizens abroad, could be monitored legally by the security services without obtaining an individual warrant because they were deemed to be external communications.

Farr said he could neither confirm nor deny the existence of Tempora, although he did acknowledge that Prism exists “because it has been expressly avowed by the executive branch of the US government”. Much of the tribunal’s deliberations therefore proceeded on the basis of agreed hypothetical facts, such as the assumption that Tempora exists. Lawyers for the government refused again, during a short hearing after the judgment, to say whether Tempora exists.

Since the tribunal was established 14 years ago, no complaint against the intelligence services has been upheld. There is no right of appeal against the court’s decisions in the British courts, although the European court of human rights in Strasbourg will consider appeals from the IPT on the grounds that claimants have exhausted all domestic remedies.

Amnesty UK’s legal adviser, Rachel Logan, said: “We will now appeal to Strasbourg, who might not be as inclined to put their trust in the UK government given what we know so far.

“The government has managed to bluff their way out of this, retreating into closed hearings, and constantly playing the ‘national security’ card. The tribunal has accepted that approach. We have had to painstakingly drag out every detail we could from an aggressively resistant government.

“The IPT’s decisions – uniquely – cannot be appealed [against] within the UK and this is a disappointing, if unsurprising, verdict from an overseer that was in part assessing itself. The government’s entire defence has amounted to ‘trust us’ and now the tribunal has said the same. Since we only know about the scale of such surveillance thanks to Snowden, and given that ‘national security’ has been recklessly bandied around, ‘trust us’ isn’t enough.”

James Welch, legal director for Liberty, said: “So a secretive court thinks that secret safeguards shown to it in secret are an adequate protection of our privacy. The IPT cannot grasp why so many of us are deeply troubled about GCHQ’s Tempora operation: a seemingly unfettered power to rifle through our online communications.”

Privacy International also plans to appeal to Strasbourg. Eric King, the organisation’s deputy director, said: “With GCHQ’s mass surveillance of undersea cables reported to have increased by as much as 7,000% in the past five years, today’s decision by the IPT that this is business as usual is a worrying sign for us all. The idea that previously secret documents, signposting other still secret documents, can justify this scale of intrusion is just not good enough, and not what society should accept from a democracy based on the rule of law.”

Carly Nyst, PI’s legal director, said: “The proceedings forced the government to disclose secret policies governing how foreign intelligence agencies, including the NSA, share information with GCHQ. Privacy International believes that the fact that these secret policies are only now public because we have forced their disclosure in court means that such rules could never make the actions of GCHQ in accordance with the law. The IPT must find that secret law is not law, and should at the very least rule that all UK access to Prism was unlawful prior to today.”

Jameel Jaffer, deputy legal director of the American Civil Liberties Union, which also took the case, said: “Mass-surveillance programs operated by the US and the UK pose a profound threat to fundamental democratic freedoms, including the right to privacy and the freedoms of speech and association. This decision only underscores both the inadequacy of existing oversight structures and the pressing need for reform.”

The home secretary, Theresa May, said: “I welcome this judgment from the Investigatory Powers Tribunal.

“The men and women of our security and intelligence agencies work hard to keep us safe. They do so in the knowledge that their greatest successes will go unnoticed and without the ability to speak out against criticism.

“Today’s judgment makes absolutely clear that the legal regimes that underpin the interception and intelligence sharing activities of the agencies and their partners are both lawful and in line with our human rights obligations.

“In reaching its conclusions, the tribunal looked at the considerable information already in the public domain about the agencies and their work – in legislation, statutory codes of practice and the reports of the interception commissioner.

“This latest judgment adds to the findings of the intelligence and security committee of parliament and the interception of communications commissioner. Between them, they have made clear that the agencies work within a strict legal and policy framework.

“As with all legislation, it is important that we keep the basis for these powers under review. That is why parliament has asked the independent reviewer of terrorism legislation, David Anderson QC, to undertake a review of investigatory powers and their regulation.

“But I hope today’s judgment provides reassurance to the public and encourages them to support the important work the intelligence agencies do to save lives and keep us all safe.”

A government security source said: “We are delighted that a third independent body has today confirmed that GCHQ does not seek to carry out mass surveillance.”