Is the security level of current widely used application such as WhatsApp, Telegram or Facebook Messenger sufficient for us to transfer the sensitive data? I believe this method is the most widely used by public users now.
Facebook Messenger and Telegram doesn't use end to end encryption by default. Your data is encrypted during transmission, but Facebook and Telegram can read your messages while it passes through its servers and they store your messages as well. Both Facebook and Telegram supports end to end encryption, but this is not default. You have to turn on Secret Conversation/Chat to enable end to end encryption. WhatsApp uses end to end encryption by default, so WhatsApp is much more secure than either in its default configuration.
However, users that wishes to use any of those services for transferring highly sensitive data need to take extra steps beyond default. In particular, in addition to enabling end to end encryption, you need to verify the other party's encryption key out of band, because otherwise you may be using an end to end encryption to talk to your adversary rather than your intended recipient. Also, Telegram have also been criticized for developing their own encryption scheme, instead of using well known secure ones. WhatsApp also has been the subject of some criticism in the way it can do transparent rekey and resend, which may leak some of your most recent messages.
Among the major encrypted instant messaging software, Signal is probably the one that's garnered the least criticism in its implementation of end to end security. WhatsApp and Facebook Messenger's end to end encryption protocol are based on Signal's protocol. All of Signals' clients and server implementations are open source, and the Signal Protocol is based on long respected cryptographic primitives. It's one of the few messaging apps that achieved perfect score on EFF's instant messaging score card.
Is the encryption feature (PGP) in email secure enough to transfer our sensitive data?
There's no known vulnerability in the basic protocol of PGP encryption as of yet. There are from time to time implementation issues like how some features of HTML mail clients interacts badly with PGP and can thus be used to leak information (EFAIL attacks). Most of the latest mail clients have patched these issues. The base cryptography itself is still solid as far as we can tell.
As to whether it's secure enough, you will have to decide, based on the sensitivity of your data and your threat model. If your main concern is preventing leaks from common petty criminals, pretty much any of these services should be secure enough. If you're talking about targeted attacks from government agencies, especially hostile governments, then not all of the services above are sufficient, and you likely need to make changes in the rest of your online habits, not just your messaging service.
