The phrase exists in American English and comes from military and intelligence practice, where it is a legitimate principle. Used anywhere else, it is an accusation. Describing a colleague as operating on a need-to-know basis is a criticism of that person, and they will hear it as one.