Yes, if the CCTV footage identifies individuals and is stored or processed digitally, it is personal data. The organisation operating the cameras (a shop, office, housing society or school) should display a notice that CCTV is in use and why, keep footage secure and delete it when the purpose is served. Use by an individual purely for personal or domestic purposes (for example a home doorbell camera) is outside the Act.