SPD should (generally speaking) be fitted to all boards, though in some cases it might not be economically worth while (where surge risk very low and value of down-stream equipment also low).
When fitted SPD should be after the incoming switch and
before and RCD or RCBO. Some SPD specify that a certain MCB should be fitted in the supply, but many of them are safe with fuse up to 100A or more and so do not require any specific protection, consult the data sheet to see (or buy a CU with the approved combinations pre-fitted).
In some cases you might have an up-front RCD as the main switch, typically for TT installations. That is an exception to the above rule of being before SPD, but it is normally a type-S (delay) RCD and typically they are rated to a higher surge current that the ones normally used for the "instant" protection of final circuits. They key point here is if the SPD is diverting a lightning surge then it might be passing of the order of 10kA, though usually only for a few tens of microseconds.
If you want an in-depth guide to lightning protection then this manufacturer's brochure is very good, but it is about 10MB PDF download and the SPD section starts on page 68:
Also worth having a copy of is the BEMA guide report here:
www.beama.org.uk
There are obviously other guides and suppliers, but not many have such a wide range of information in the one place.
TL;DR Fit the SPD immediately after the main switch, and keep the wires short and close together to minimise inductance.