Most MVC frameworks have some soft or form DTO notion, as a form does not map 1-on-1 to one db record. The form DTOs in our app also holds the logic to validate

Most MVC frameworks have some soft or form DTO notion, as a form does not map 1-on-1 to one db record. The form DTOs in our app also holds the logic to validate itself. Basically, like sibling post mentioned: you put it where it makes sense. Doing validation on db entities, is certainly not a place it makes sense (except in the most trivial cases, hence the common mistake).