Schema.org - JSON-LD - Where to Place?
The data can be placed anywhere. From Google's documentation:
The data, enclosed within the
<script type="application/ld+json">...</script>tags as shown in the examples below, may be placed in either the<HEAD>or<BODY>region of the page that displays that event.
You can also use data dynamically fetched using AJAX:
JSON-LD markup inserted by Javascript that runs upon initial page load can be recognized.
Update (as pointed by Antony in the comments)
The latest documentation says:
[JSON-LD is a] JavaScript notation embedded in a tag in the page head or body... Google can read JSON-LD data when it is dynamically injected into the page's contents, such as by JavaScript code or embedded widgets in your content management system.
From the perspectives of Schema.org, JSON-LD, and the possibly extracted RDF, it should not matter. The data is the same, no matter from where in the document it got extracted.
From the perspective of HTML5:
If it’s data about your page (or what this page is about), you could place the script element in the head, as the head element
[…] represents a collection of metadata for the Document
But of course it would not be wrong to use body for this instead. It’s just that you shouldn’t use head for data that is not about your page or what it represents.