Under the LGPD (Lei 13.709/2018), NAV Brasil processes the personal data of candidates in its hiring examinations. Which statement correctly reflects the law?

1. Processing must observe a legal basis and principles such as purpose and necessity, and the data subject holds rights such as access and correction of their data
2. Any public or private entity may process personal data freely once it is collected
3. The law applies only to data stored on paper, not to digital databases
4. Consent is the only legal basis available for every kind of processing