The data can be placed anywhere. From Google’s documentation:
The data, enclosed within the
<script type="application/ld+json">…
</script>tags as shown in the examples below, may be placed in either
the<HEAD>or<BODY>region of the page that displays that event.
You can also use data dynamically fetched using AJAX:
JSON-LD markup inserted by Javascript that runs upon initial page load
can be recognized.
Update (as pointed by Antony in the comments)
The latest documentation says:
[JSON-LD is a] JavaScript notation embedded in a tag in the page head or body… Google can read JSON-LD data when it is dynamically injected into the page’s contents, such as by JavaScript code or embedded widgets in your content management system.