Both in the business layer with partial rule enforcement in the data layer
In The Logical Layering Of A Multi-tiered Architecture System, Most Commonly Where Do The Business Logic And Business Rules Reside?