Best practices for DAO

What are the best practices for designing and implementing a DAO pattern for database?

Particularly what are the answers for the following questions?

1. If some entity has link to other entity, let's say Employee and Department, should the model of this entity(Employee class) save only id of other(foreign key from database) or the whole object(Deparment object)?
2. Should parameters to DAO functions be just ids or objects?
3. Should I check for unauthorized usage of DAO functions or this should be done on service layer?
4. Should I throw and handle exception or this should be done on service layer?
5. Should I set Object to null, if it is deleted from database?

UPD: JDBC is used