New changes to Canadian privacy law will require companies to disclose more information about cyber-attacks and be more proactive about disclosing potential risks that may leave them vulnerable.