Data encryption key
The key that encrypts the data itself, while another key encrypts this one.
In envelope encryption, data is encrypted with a data encryption key (DEK), and the DEK is in turn encrypted with a key encryption key (KEK) held in an HSM or a KMS. Rotating the KEK only means re-wrapping the DEKs, not re-encrypting gigabytes of data. And destroying the KEK makes the stored data unreadable.
The reason is practical: bulk encryption is fast with a symmetric key, but key management should be centralised and auditable. A common mistake is using one key at both levels, which makes rotation expensive.