The GDPR requires the processing entity to apply "Appropriate Technical and Organisational Measures" to ensure compliance. Article 32 says
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, [...]
Article 40 (2) says
Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation
(h) the measures and procedures referred to in Articles 24 and 25 and the measures to ensure security of processing referred to in Article 32;
These articles do not spell out directly that revealing passwords is against proper TOM, but in my judgement revealing a personalized password is not in accordance with the state of the art. When there is a technical requirement to share secrets between several individuals, they should be kept in a secure system where each user has an individual, non-shared access that can be logged.
But involving the GDPR that was might not be the most reasonable or constructive solution to the problem. This isn't really a question for Law SE, it is one for The Workplace SE or Information Security SE.
If the laptop contains only business/professional data, help them to recover that data. Meet in a cafe or somewhere like that. Log in. Copy all data files onto a stick. If your friend is the only one with an admin account, have her create another admin user for the company.
If the situation is tense, bring a witness and have the company sign a protocol of what was done and precisely when. This should have been done during out-processing.