Did you see 285.21(A)?
It does reference 230.82.
The general rule in the NEC is for the SPD to be on the load side of at least the service overcurrent device, or have it's own OCPD.
Here is some info from the UL White Book, 2008
SURGE PROTECTIVE DEVICES
(VZCA)
GENERAL
This category covers surge protective devices (SPDs) designed for
repeated limiting of transient voltage surges as specified in the standard on
50 or 60 Hz power circuits not exceeding 1000 V and designated as follows:
Type 1 ? Permanently connected SPDs intended for installation
between the secondary of the service transformer and the line side of
the service equipment overcurrent device, as well as the load side,
including watt-hour meter socket enclosures and intended to be
installed without an external overcurrent protective device.
Type 2 ? Permanently connected SPDs intended for installation on the
load side of the service equipment overcurrent device, including SPDs
located at the branch panel.
Type 3 ? Point-of-utilization SPDs, installed at a minimum conductor
length of 10 m (30 ft) from the electrical service panel to the point of
utilization, e.g., cord-connected, direct plug-in, receptacle type and
SPDs installed at the utilization equipment being protected. The distance
(10 m) is exclusive of conductors provided with or used to attach
SPDs.