It is usually said that who is used for people (and sometimes animals) while that is used to refer to objects.
In actual usage, though, both who and that can be used to refer to persons, sometimes to animals, and sometimes to entities that consist of people.
- The dog who/that chewed the bone chased the cat.
- The person who/that stole my purse used all my credit cards.
- The group who/that went shopping was mugged.
That, not who, is used to refer to objects.
- The house that Jack built is falling down.
Here's what Oxford Dictionaries Online says:
It is sometimes argued that, in relative clauses, that should be used for non-human references, while who should be used for human references: a house that overlooks the park but the woman who lives next door. In practice, while it is true to say that who is restricted to human references, the function of that is flexible. It has been used for human and non-human references since at least the 11th century, and is invaluable where both a person and a thing is being referred to, as in a person or thing that is believed to bring bad luck.
For more examples of actual usage, here's a link to Merriam Webster's Dictionary of English usage (see pages 895 and 896).