A “data subject” is defined by GDPR as an “identified or identifiable natural person” from whom or about whom information is collected. A company or organisation cannot be a data subject.
A data subject has rights under the GDPR that aims to protect its privacy and right to self-determination. The GDPR is built around requirements on organisations that use personal data (controllers and processors) to protect the rights of the data subjects.
The legal definition of the data subject can be found in Article 4, paragraph 1 of the GDPR.