If the data is encrypted using a session key and then the session key encrypted with a master key and stored with the data (concat them together) then it can. Y

If the data is encrypted using a session key and then the session key encrypted with a master key and stored with the data (concat them together) then it can. You can't revoke access to the data they've already got, of course, but as changes/additions are made they lose the ability to decrypt the new data because you've used a new session and master key. Arq uses this method when encrypting blobs.