Seperate out validations from a service and use custom exceptions for entities not found
As I do not know the other entities beside "Student" it becomes very hard to evaluate it.

One general thing: having duplicate code does not mean you have a problem. The problem comes if the duplicate code comes with real duplicate semantic for your business domain.

It may be that you are missing an business relevant abstraction of "Student" and the other entities that have std or division in common. But you should think about that if there is really a proper abstraction. You can test it by making up an artificial requirement that affects the Student and the std or division. If the other entities must change as well to have a consistent model then there is semantic duplication and you should consider an abstraction or composition.

If you have identified an abstraction to be proper then you can abstract the null checks as well. Another way is to encapsulate std and division in one object and provide a validate-method that does the check. Furthermore search the internet for refactoring methods like "introduce parameter object".

If you haven't identified an abstract responsibility then leave your code as it is. Otherwise you may fall into a type II error. (Acting if there is a problem, but there isn't). This is related to the SRP. Robert C. Martin shows this in one of his talks: https://youtu.be/Gt0M_OHKhQE?t=698. As well as you should remove duplicate responsibilities you also should separate different responsibilities.

Some other things:


You said you have a business layer but the separation isn't proper. And here is why: Your "business layer" is responsible to serve a web service by throwing a BadRequestException. You are mixing in technologies that belong to other layers.
You do not distinguish between proposal objects, consistent business objects and communication objects. They are all same (StudentDTO in, StudentDTO out).
The null checks are not business relevant. They are a result of mapping from one representation (String) to another representation (Std, Division) while you do not know if the source made proper assumptions of the presents of the requested business objects. This is related to the web service layer that has to ensure to pass correct non-null values to the business layer. On the other side you have code that composes an entity in the same method. That should be separated at least into another class but after all it is a different layer, maybe the business layer, in my opionion the dao layer.