This is one that people argue about. If you are learning English, to avoid these arguments, learn to use "who," because everyone agrees that it is correct, and--unlike some other "textbook English" usages--it does not sound formal or stilted. However, "that" is also standard usage, so if you see it, do not try to "correct" it.
The American Heritage Dictionary says:
"There is a widespread belief, sometimes taught as correct usage, that only 'who' and not 'that' should be used to introduce a restrictive relative clause identifying a person. But 'that' has been used in this way for centuries, going back to the Old English period, and has been used by the finest writers in English, as in 'The man that once did sell the lion's skin / While the beast liv'd, was kill'd with hunting him' (Shakespeare). and 'Scatter thou the people that delight in war' (King James Bible). In contemporary usage, 'who' predominates in such contexts, but 'that' is used with sufficient frequency to be considered standard, as in 'The atoms in a diamond ... outnumber all the people that have ever lived or ever will' (Richard Dawkins)."
I quickly found examples of both usages in the writing of a single respected author, Mark Twain. He wrote a story entitled "The Man Who Corrupted Hadleyburg," and he also wrote, of Joan of Arc, "In several ways she is the most interesting woman that ever lived, and the most extraordinary."