Yes, a child can be a data subject. The GDPR has specific rules for personal data about children, but they can still be data subjects.