There's no rule to DIT structures in any LDAP implementation. Remember that LDAP is an access protocol and has nothing to do with the storing, managing or manipulating of the data. It's merely a method to access that data.

Storing data within your Directory Services (DS) model should be well thought-out. There's no one design-fits-all yet there's something that's quite near it for large enterprises or those companies looking to do identity management/provisioning etc. That's the hub-spoke design with an identity 'vault' at the center with connections (or federation) to disparate systems.

Never use OUs where attributes will do -- no need to divide your user accounts in differing sub-tree searches but rather write your applications to query one sub-tree searching for specific attributes (ie, instead of ou=acct,ou=example,o=org, try searching ou=users,o=org for a specific attribute like dept? why not extend the schema and include this information?

Virtual directories will also shape your thinking around how to design and setup directories as more and more applications will use virtual directory services (and/or federation) for access and control.

I could write a book . . . :)