Example implementations relate to privacy risk assessments. Some implementations may include a privacy risk identification engine to automatically identify privacy risks in an application based on an analysis of application code. Additionally, some implementations may include a privacy risk identification engine to obtain privacy risk information related to each of the privacy risks. Moreover, some implementations may include a privacy risk assessment engine to assess a severity of each of the privacy risks based on an analysis of the privacy risk information. In some examples, the analysis may include a determination of, for each of the privacy risks, a risk impact and a risk likelihood.