Application level encryption and key renewal
DEK (data encryption key): The key that encrypts the actual content. 
The DEK gets changed less often than the KEK (see below).

KEK (key encryption key): The key that encrypts the DEK.
The KEK gets changed ("rotated") at regular intervals according to best practices and company security policies. 

As the volume of content grows, the more arduous it will be to rotate the DEK. You still might actually rotate a DEK from time to time, but doing so would mean re-encrypting all of your content with a new key. 

It is much easier to simply use a new key to re-encrypt the DEK, rather than re-encrypting the content that was encrypted by the DEK, since encryption keys are tiny compared to the content that they encrypt.

You should rotate the KEK as you go, over time, whenever its expiration date passes, or incidentally, such as in the event of a breach or a suspected breach.