Yes—anyone can be a data subject, including residents, refugees, tourists, and even people outside of a country where the GDPR directly applies. Whether a person is a citizen of a European country is not relevant to whether they are a data subject.