Key rotation policies can be... complex and bureaucratic, and the specific wording may dictate the method of rotation you must use, and how often it is done.
Method 1 is not just messy and computationally expensive, but it requires decryption of all data, increasing risk of exposure.
Method 2 is substantially more common, however you should be using more than 1 master key based on age. As old master keys expire, you reencrypt the subkeys using that master key with a new one. That way there is a not a period in time that requires you to change ALL keys at the same time, possibly within a specific timeframe dictated by policy that is now impossible to meet.
My terminology defines the subkey as the one which encrypts data, and the master key as the one which encrypts subkeys. This type of key rotation may meet the policy requirement.
Since encrypted data does not expire, I assume the data set grows over time. You should determine how many master keys can be reasonably managed, and if there will ever be a point where there are not enough for their subkeys to be reencrypted in a reasonable period of time before the next master key needs to be changed. If you are maxing out a CPU 24/7 to change keys you have a problem.
If policy dictates you must change the data key, the key rotation period may be different than that for a master key, and using both types of key rotation will save a lot of compute resources if the data key period is longer.
If you or someone else has the power to creatively interpret policy, you can use layered encryption and last-access-times to manipulate key rotation schedules. For example, a master key rotation period may start the first time it is accessed for decryption of a subkey.
If you are actually looking to increase security through key rotation rather than just meeting a policy requirement, they master keys should all be secured through hardware encryption in a way where they are never directly exposed, and access should be tightly controlled and logged. Sloppy key rotation only adds more opportunity for data to be exposed.