There is no clear answer to this question.
- The GDPR doesn't not apply, but it delegates rules for processing in the context of employment to member states. That means, the laws in your country might override the GDPR here.
- As the data controller in this situation, the company must protect the personal data it processes, including the personal data of employees. Protection doesn't have to be absolute, just proportional to the risks. It may be fine to treat data in one context more carefully than another. This is always a judgement call of the data controller.
There is nothing about holiday rotas where the GDPR would require them to be kept under lock. The company could very well decide that this data isn't very sensitive and that everyone can look at it themselves. For example, the company might argue they have a legitimate interest for this so that employees can see whether their colleagues are unavailable.
But until the controller makes such a decision, the rota contains other person's personal data and cannot be disclosed without a legal basis.
Here, I see three reasons why the company might be acting that way:
- They are overly careful with GDPR compliance and are cargo-culting restrictions that are not actually necessary.
- They have made a conscious decision to restrict access to this data to protect the private life of employees.
- They want to make it more difficult for employees to take time off.