Yes they can.
You have made the classic misunderstanding - it's not your Macbook, it's your employer's Macbook which they have assigned to you to use. It remains however their property.
The finer details of what the company can access on a device they have assigned for your work use depend upon the legal jurisdiction this is taking place in, and what data they are trying to access.
You have very little protection in India, while it is "recommended" that employers obtain employees consent for monitoring of their electronic conduct, it is not mandatory and Indian law does not otherwise protect employees’ rights to privacy with regard to electronic device usage. If the device belongs to the company then they have the absolute right to access the device under Indian law. (Accessing any of your personal social media or email accounts is a murky area in Indian Law but there's some cyberstalking provisions that would probably make it illegal, IANL though!)
In the US if the password is preventing access to the entire system (such as a BIOS password or disk encryption) then they can require you to give up access to it. In extreme cases you can even go to jail if you don't!
As regards protection of your personal files and data on a work device it largely depends upon what their policies say so you need to start reading that fine print ASAP, generally if they have reasonable cause to suspect some violation of policy or duties or other misconduct then they can access your computer to investigate and this trumps your Reasonable Expectation of Privacy - see Leventhal v. Knapek (consenting to the employer monitoring or accessing your data doesn't remove the Reasonable Expectation of Privacy from a Fourth Amendment perspective but that only protects against the government looking at it sans warrant and prevents the company consenting to the same on your behalf see US v. Ziegler)
You are somewhat more protected in the EU - individual files/emails etc on work devices have a limited amount of protection via Article 8 of the Human Rights Act ("Right to respect for private and family life") - this means that if something is of an evidently personal nature then it can only be accessed by the company if there is a legitimate business need for them to do so and this access is limited to the minimum number of personnel necessary to fulfill this need. The fact that the company may monitor or access personal communications or files also needs to be made known in advance to the employee (IT policies, employee handbook etc.)
This protection only applies to things that are "evidently personal in nature" though - if there is company data on your Macbook (or the company could reasonably believe that there is company data on there) and we're talking about a full disk encryption scenario then they can absolutely require you to give up the password. If, once decrypted they see a folder called "Personal Files" (for example) then they wouldn't be allowed to access that folder without satisfying the "business need" and prior notification requirements etc mentioned above.
This is where the legal minefield that Lillienthal mentions in the comments below comes in and each individual case and it's circumstances would be considered on it's own merits by the courts.
As an example in 2007 a Romanian man was suspected of sending personal communications on a work device during work hours. The company read his yahoo messages and saw evidence of him doing just that and fired him. It went to court and in January 2016 the European Court of Human Rights (ECHR) ruled in favor of the company, as the judge in that case put it:
"not unreasonable that an employer would want to verify that employees were completing their professional tasks during working hours"
This ruling was subsequently reversed by the Grand Chamber of the ECHR earlier this year, not because the company wasn't allowed to read the personal information but rather that they had intruded further into the man's personal life than was necessary to satisfy their business need and that they had failed to notify him in advance that his communications may be monitored. Basically they had failed to correctly follow procedure.
TL;DR - Depending on where you are access to personal files and data may be protected, access to the entire computer is not.