Start here. This is the direct spoken answer to practice first.
Overview
The validation mechanism depends on whether the rule belongs to one submitted object or requires application state.
I put constraints on the nested DTO and mark the containing property with @Valid so validation cascades into it. The same applies to elements of a collection when each element has its own constraints. A rule involving two fields in one request, such as an end date after a start date, can use a class-level custom constraint. The validator reports a stable field or object error without performing database or remote calls.