The Data Access layer is that part of the application where all of the data access and data update logic is placed. Data access/update code (calls to the ADO.Net API) will be placed only in the data access layer. No other layers should need references to SQL databases.
All non-atomic updates (insert, update, delete) to a database require transaction support.
All updates (insert, update, delete) to a database require concurrence checking.
To reduce the vunerability of SQL injection attacks, SQL parameters or an ORM should be used.