Sami Khoury, head of the Communications Security Establishment (CSE) Canadian Centre for Cyber Security, said users need to be aware of what they're agreeing to when they download an app, and should ask whether it enables access to their personal data.

"You have to ask yourself the question, do they need to access that information? Why does an application need to access all of my contact list? Why does it need to access my calendar, my email, my phone records, my [texts]?" he told CBC News.

"You layer on top of that the risk of connecting my 200 [contacts] with your 200 and then you have an aggregate ... of information. In some cases, it lands in places that don't live by the same principles of rule of law [and] respect for human rights."

Tiktok's parent company is China's ByteDance.

In a statement, a spokesperson for TikTok insisted the Chinese Communist Party has no control over ByteDance, that it has never provided Canadian users' data to the Chinese government and that it would not do so if asked.

The CSE said Canadians with commercially sensitive information on their devices should be especially cautious when granting access to their devices.

"Some platforms are responsible platforms where you potentially don't have to worry about the data falling into the hands of a nation-state. But other platforms are too close to that line," Khoury told CBC News.