Application level encryption and key renewal (I had posted this question on stackoverflow and been asked to move it to crypto.)

I have a question related to encrypting data in the database, at the application level.

The application will encrypt the data (e.g. using AES) when persisting it to the database and decrypt the data once they have been retrieved from the database.

Is there any good technic to renew the encryption key?

If for example a company has a policy to renew the encryption key every two years we would end up in a position where we have to decrypt the overall database with the old key, and reencrypt it with the new one every two years.

Is there any technic to avoid such an issue?

I had the following answers: https://stackoverflow.com/questions/37172931/application-level-encryption-and-key-renewal

I mentionned AES because it is an industry standard. Would Paillier be fit for the industry?
DEK (data encryption key): The key that encrypts the actual content. 
The DEK gets changed less often than the KEK (see below).

KEK (key encryption key): The key that encrypts the DEK.
The KEK gets changed ("rotated") at regular intervals according to best practices and company security policies. 

As the volume of content grows, the more arduous it will be to rotate the DEK. You still might actually rotate a DEK from time to time, but doing so would mean re-encrypting all of your content with a new key. 

It is much easier to simply use a new key to re-encrypt the DEK, rather than re-encrypting the content that was encrypted by the DEK, since encryption keys are tiny compared to the content that they encrypt.

You should rotate the KEK as you go, over time, whenever its expiration date passes, or incidentally, such as in the event of a breach or a suspected breach.